Database/AI/ML frameworks & serving
NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpoints
Impact
The sandbox's layer-7 REST policy is what decides which endpoints code running inside it may reach. A path traversal in that matcher lets a request be crafted so the policy check passes but the request lands on an endpoint the policy was meant to block. NVIDIA rates the scope as changed with high confidentiality and low integrity impact, which is consistent with sandboxed workloads reading and partially tampering with services outside their allowed set. On a fleet where the sandbox is the boundary between tenant-supplied agent code and internal APIs, that boundary is the whole control, so a bypass means untrusted code reaches internal services directly.
Who can reach it
An attacker who can already run code inside or submit requests through the sandbox (CVSS PR:L, network-reachable). Low privileges are required; no user interaction.
What to do
NVIDIA's advisory (product-security bulletin 5872) is the authority on fixed versions; the CVE record itself names none, so do not assume a version number. Update the OpenShell Sandbox package and restart the sandbox service once the fixed build is identified; until then, treat the L7 REST policy as advisory rather than enforcing and put a real network policy or egress proxy in front of the sandbox.
References
Related entries
- Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
- skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
- mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High
- mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High
- Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
- Dagster: Vulnerability in Dagster Core prior to 1.13.1CVE-2026-41490 · DagsterHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.