Docker Sandboxes: case-variant OAuth hostname bypasses credential masking, leaking host tokens

Impact

Docker Sandboxes injects host-managed credentials into a sandbox while masking the provider's token responses, but it compared OAuth token-endpoint hostnames case-sensitively where DNS routing is case-insensitive. Untrusted code running inside the sandbox can request a case-variant of the real token endpoint, reach the genuine provider, and receive the access and refresh tokens unmasked. That turns a sandbox meant to contain untrusted agent or model-generated code into a credential exfiltration path: whatever the host account is authorised for - registries, repos, cloud APIs - becomes reachable from inside the container. The flaw is in the isolation layer, so the blast radius is set by the scope of the credentials the operator configured, not by anything the sandbox itself holds.

Who can reach it

Code already executing inside a Docker Sandbox - for example a generated or third-party tool an agent runs. The record's vector requires user interaction (UI:A): a user has to complete the OAuth flow for the tokens to be returned.

What to do

Update Docker to a release containing the fix; the advisory text in the record does not name a fixed version, so confirm against Docker's own release notes before planning the rollout. Until then, treat anything running in a sandbox as able to read injected credentials: scope managed credentials narrowly, avoid injecting long-lived refresh tokens, and rotate any provider tokens that were available to sandboxes running untrusted code.

References

Related entries

• JFrog Artifactory Helm chart: generated TLS private keys retained in rendered manifestsCVE-2026-66016 · JFrog Artifactory self-hosted Helm deployment (generated TLS private keys)Medium
• Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
• Envoy: large requests crash the TCP connection pool via a null buffer watermark callbackCVE-2025-62409 · Envoy (TCP connection pool flow control / buffer watermark callbacks)Medium
• Argo CD (Helm OCI repository credential logging): CREDENTIAL DISCLOSURE THROUGH THE LOG PIPELINE: Argo CD wrote theNCVD-2021-016-argo-cd-helm-oci-repository-cred · Argo CD (Helm OCI repository credential logging)Medium
• Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium
• Kubernetes (kubectl): `kubectl cp` path traversal from a malicious container tar overwrites files on the operator'sCVE-2019-11246 · Kubernetes (kubectl)Medium