Docker Desktop logs may have recorded third‑party API keys and OAuth tokens in cleartext due to missing payload redaction. The stored tokens are not Docker account tokens but still provide access to external services. If a user with read rights to the log or diagnostic files views them, the attacker gains possession of these credentials, enabling unauthorized access to the associated third‑party accounts. This exposure aligns with CWE‑532, which signifies information disclosure through log files.

Docker Desktop versions prior to 4.97.0, including 4.94.0 and 4.95.0, are affected. The issue persists in any logs or crash dumps generated by these releases, even after upgrading to 4.97.0 unless the existing files are removed or reset.

The CVSS base score of 5.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The likely attack vector demands local read access to the host’s log files; therefore, an attacker with system-level or delegated file‑system permissions can exploit the flaw. Docker Desktop 4.97.0 not only stops new credential writes but also performs cleanup of existing host logs and crash dumps to mitigate this risk.