CVE-2026-105452
Medium
Description
Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in another supported authentication header. For affected upstream services, this could authenticate the request to an attacker-controlled account and expose data included in the request.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Docker Sandboxes
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- docker docker_sandboxes0.43.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker docker_sandboxes | 0.21.0 ≤ v < 0.43.0 | 0.43.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.