Docker Sandboxes: egress proxy strips only sentinel-valued credentials, letting sandboxed code attach its own

Impact

The host egress proxy removed client-supplied credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could set an unrecognized credential in another supported authentication header and have it forwarded alongside the host-injected one. For upstream services that honour the attacker's header, the request authenticates to an account the attacker controls, and whatever data the request carried - prompts, context, files pulled from the sandbox - lands in that account. This is a data-exfiltration channel out of a sandbox that an operator is relying on to contain agent workloads, and it is separate from the response-masking failure in CVE-2026-101998. The record reports confidentiality impact only.

Who can reach it

Code running inside an authorized sandbox, no additional authentication needed beyond being allowed to run there; the CVSS 4.0 vector given is local with no privileges required and a passive attack requirement.

What to do

Update Docker Sandboxes to a fixed release and restart the sandbox tooling. The record cites only Docker's sandbox and credential-injection documentation and names no fixed version, so check Docker's release notes for the version that stops forwarding alternate authentication headers. Until then, review upstream service logs for requests that authenticated to unexpected accounts, and avoid giving sandboxes proxy access to services whose data you cannot afford to see posted elsewhere.

References

Related entries

• vLLM: arbitrary HTTP method tokens create unbounded Prometheus label sets and exhaust the serviceCVE-2026-105759 · vLLM Rust frontend track_http_metrics middleware (Prometheus label cardinality)Medium
• Ray (dashboard DELETE endpoints): Browser-origin protection covers POST/PUT but not DELETECVE-2026-27482 · Ray (dashboard DELETE endpoints)Medium
• LocalAI (`/models/apply`): SSRF and partial local file inclusionCVE-2024-6095 · LocalAI (`/models/apply`)Medium
• NVIDIA NemoClaw: insufficiently protected credentials allow information disclosure and data tamperingCVE-2026-65087 · NVIDIA NemoClaw (credential storage)Medium
• Linux perf/x86/amd/uncore - memory leak in the events array: Per-CPU northbridge and last-level-cache uncore contextsCVE-2022-49784 · Linux perf/x86/amd/uncore - memory leak in the events arrayMedium
• PyTorch (flatbuffer loader): Out-of-bounds read parsing flatbuffer modelCVE-2024-31584 · PyTorch (flatbuffer loader)Medium