CVE-2026-105452 in Sandboxes
Summary
by MITRE • 10/08/2026
Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in another supported authentication header. For affected upstream services, this could authenticate the request to an attacker-controlled account and expose data included in the request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability described involves a critical flaw in how Docker Sandboxes handle HTTP authentication headers during egress traffic processing by host-level proxies. This issue stems from insufficient validation of credential fields within multi-header authentication scenarios, allowing untrusted code executing inside an authorized sandbox to manipulate the identity context perceived by upstream services. The core technical failure lies in the logic employed by the host egress proxy when stripping or overriding credentials injected into outgoing requests. Specifically, the proxy was designed to remove alternate credentials only if their values matched specific known sentinel values intended to indicate default or system-generated identities. This approach assumes that any credential not matching these predefined sentinels is safe to retain or forward alongside other authentication data. However, this assumption creates a bypass mechanism where an attacker can supply a custom, unrecognized credential in a supported authentication header field. Because the proxy does not validate whether such credentials are legitimate or authorized for the specific sandbox context, it forwards them along with any existing host-injected credentials.
This architectural oversight leads to a severe identity confusion scenario known as credential forwarding abuse. When an attacker controls untrusted code within a Docker container that is part of a trusted network segment, they can craft HTTP requests containing multiple authentication headers or complex header values. By injecting a custom credential value that does not match the sentinel patterns checked by the proxy, the request bypasses the cleanup logic. Consequently, both the host-injected credentials and the attacker-supplied credentials are transmitted to the upstream service. Most modern web services and API gateways process these requests using first-match or specific header precedence rules. In many configurations, if multiple authentication schemes are present, the server may prioritize the client-provided credential over the system-level one, especially if it appears in a standard Authorization header that is parsed before proxy-injected headers. This allows the attacker to authenticate as an arbitrary account controlled by them rather than the intended service identity or sandbox user.
The operational impact of this vulnerability is significant, primarily revolving around unauthorized access and data exposure. Since the request successfully authenticates using the attacker-controlled credentials against upstream services, the attacker gains the ability to perform actions under that compromised identity. This can lead to full account takeover if the targeted credential belongs to a privileged service account or an administrative user within the backend infrastructure. Furthermore, because the vulnerability allows for the injection of arbitrary data into authenticated requests, it facilitates direct exfiltration of sensitive information contained in those requests. Attackers can exploit this to read confidential business logic, access private customer data, or manipulate state-changing operations such as financial transactions or configuration changes. The scope of impact extends beyond individual containers; if upstream services are shared across multiple tenants or microservices, a single compromised sandbox could potentially pivot to affect other parts of the distributed system by leveraging valid credentials from different identities.
From a classification perspective, this vulnerability aligns with CWE-287: Improper Authentication and CWE-913: Improvement of Control when Adding New Functional Components, as it involves flawed logic in handling authentication inputs during proxy processing. It also maps to MITRE ATT&CK techniques such as T1078: Valid Accounts, where attackers use legitimate credentials obtained through compromise or injection to maintain access without triggering typical security alerts related to invalid login attempts. The attack vector is classified as Local Privilege Escalation in the context of container isolation boundaries, specifically leveraging network egress controls rather than kernel-level escapes.
Mitigation strategies must address both the immediate configuration flaws and broader architectural assumptions regarding trust boundaries between containers and host proxies. First, organizations should update their Docker sandbox environments and associated proxy software to versions that implement strict allow-listing for authentication headers or enforce single-credential policies during egress processing. The logic for stripping credentials must be revised to remove all client-supplied authentication data regardless of its value, ensuring only system-injected identities are forwarded upstream. Additionally, implementing mutual TLS (mTLS) between the sandbox network and upstream services can decouple identity from HTTP headers entirely, relying on certificate-based authentication which is immune to header injection attacks. Security teams should also audit their proxy configurations to ensure that sentinel values are not relied upon as the sole mechanism for credential sanitization. Regular penetration testing focused on container egress traffic patterns will help identify similar logic flaws before they can be exploited in production environments.