Docker Sandboxes: proxy fails open when masking credentials, leaking host OAuth tokens to sandboxed code

Impact

Docker Sandboxes injects host-held credentials into outbound requests from an agent sandbox and masks them in responses so the code inside never sees them. When a response-body read returned data together with an error, affected handlers forwarded the unmasked bytes, so code running inside an authorized sandbox could recover the host's OAuth access and refresh tokens or a derived Anthropic API key. On a fleet that runs agent workloads in these sandboxes, the boundary that was supposed to keep provider credentials outside tenant code does not hold: whoever controls the code in one sandbox can walk away with a long-lived credential and spend against it from anywhere. The record reports no integrity or availability impact and no scope change.

Who can reach it

Code already executing inside an authorized Docker Sandbox - so an operator or tenant who can submit an agent workload, or a prompt-injected agent, not an unauthenticated outsider. The CVSS 4.0 vector given is adjacent-network with low privileges and a passive attack requirement.

What to do

Update Docker Sandboxes to a release that contains the fix and restart the sandbox tooling; the record links only Docker's sandbox documentation and does not name a fixed version, so confirm the version against Docker's own release notes before declaring nodes clean. Treat any credential that was injected into a sandbox during the exposure window as disclosed: rotate the host OAuth tokens and any derived API keys rather than relying on the patch alone.

References

Related entries

• Docker Sandboxes: egress proxy strips only sentinel-valued credentials, letting sandboxed code attach its ownCVE-2026-105452 · Docker Sandboxes (egress proxy alternate-credential stripping)Medium
• vLLM: arbitrary HTTP method tokens create unbounded Prometheus label sets and exhaust the serviceCVE-2026-105759 · vLLM Rust frontend track_http_metrics middleware (Prometheus label cardinality)Medium
• Ray (dashboard DELETE endpoints): Browser-origin protection covers POST/PUT but not DELETECVE-2026-27482 · Ray (dashboard DELETE endpoints)Medium
• LocalAI (`/models/apply`): SSRF and partial local file inclusionCVE-2024-6095 · LocalAI (`/models/apply`)Medium
• NVIDIA NemoClaw: insufficiently protected credentials allow information disclosure and data tamperingCVE-2026-65087 · NVIDIA NemoClaw (credential storage)Medium
• Linux perf/x86/amd/uncore - memory leak in the events array: Per-CPU northbridge and last-level-cache uncore contextsCVE-2022-49784 · Linux perf/x86/amd/uncore - memory leak in the events arrayMedium