L3 · ShartedDocker · credentials · virtualizationdocker-desktop-october

Docker Desktop 4.97.0 fixes credential logging and a VM networking flaw

Docker Desktop 4.97.0 fixes third-party credential logging and a kernel networking flaw reachable from a container. It also cleans existing host logs/crash dumps; older copied or shared diagnostics need separate cleanup.

Disclosed: Oct 26, 2026; Public disclosure date
Severity: Sharted; 2 CVEs tracked here
Splash zone: Docker Desktop before 4.97.0; readable logs/diagnostics or container access to the affected VM networking path; docker
In the wild: Unknown; Docker’s release notes do not report malicious exploitation.

What happened

L3 reflects security-boundary failures in a mainstream developer tool. Neither a confirmed host takeover nor a victim count is established. The separate eMudhra trust-store response still requires attention; this release batch concerns different flaws.

The kernel flaw was already public before this Desktop release; this entry covers the October 26 Desktop remediation batch, not a newly discovered Linux bug.

What’s in the bowl

CVE-2026-114409

Third-party credentials logged in cleartext

Docker’s CNA identifies versions 4.39.0 to before 4.97.0. Insufficient IPC redaction exposes third-party API keys/OAuth tokens to readers of local logs or diagnostic bundles; these are not Docker account tokens.

CVE-2026-99999

VM network-stack corruption

A container can abuse bad IPv4 checksum metadata through TUN or AF_PACKET to corrupt the VM network stack; the notes do not establish a host escape.

Fixed versions

Product	Safe from	Note
Docker Desktop	`4.97.0`	Includes existing host-log/crash-dump cleanup

Crime-scene timeline

Oct 15, 2026
Linux publishes the underlying kernel CVE
Oct 26, 2026
Docker Desktop 4.97.0 released
Oct 27, 2026
Docker publishes the credential CVE record

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Docker security announcementsPrimaryTwo fixes and historical diagnostics cleanup requirements.
Docker Desktop 4.97.0 release notesPrimaryOctober 26 release; distinguishes credential logging from VM network-stack corruption.
Docker CNA credential recordPrimaryAffected Desktop range starts at 4.39.0; October 27 CVE publication follows the release.
Linux CNA network-checksum recordPrimaryUnderlying kernel CVE was public October 15; October 26 is the Desktop remediation batch.

Wipe guide

The wipe checklist

0 of 3 sheets used

Verify the Desktop application versionUpdate through Docker’s official release channels and verify 4.97.0 in Docker Desktop. A docker client/Engine version alone does not identify the Desktop application build.
Find exported logs and diagnosticsDelete or sanitize bundles generated/shared with 4.96.x or earlier and logs copied elsewhere. Earlier 4.94.0/4.95.0 changes covered known logging paths but could leave historical credentials behind.
Revoke credentials if they were exposedGeneral response guidance: assess who could read the affected files, revoke/rotate exposed third-party API keys or OAuth tokens, and review provider activity. Preserve necessary evidence before cleanup.