CVE-2026-61670 in microsandbox
Summary
by MITRE • 09/18/2026
microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in microsandbox versions prior to 0.5.10 represents a critical information disclosure flaw rooted in improper handling of sensitive configuration data during the initialization of local-first microVMs. Microsandbox operates as a runtime and library designed for creating isolated execution environments, yet its implementation failed to adequately protect secret values passed via command-line arguments when spawning new sandbox instances. Specifically, the sdk/rust/lib/runtime/spawn.rs module was responsible for serializing NetworkConfig secrets into the --network-config argument. Additionally, per-sandbox secrets were transmitted through repeated --env arguments processed by crates/cli/lib/sandbox_cmd.rs. This architectural decision to expose sensitive data via standard command-line interfaces created a significant security gap that undermined the isolation guarantees expected from microVM technology.
The core technical flaw lies in how operating systems handle process information visibility. When an application passes secrets as part of its command line, these values become visible in the host system's process table for the duration of the process execution. On Linux systems, this data is accessible through /proc/[pid]/cmdline and other proc filesystem entries. Similarly, on macOS and other Unix-like operating systems, standard process listing utilities such as ps or top can reveal command-line arguments passed to running processes. Consequently, any local user account with read access to the host's process table, or co-resident processes sharing the same namespace, could inspect these memory-mapped or file-based representations of the command line. This exposure persists for the entire lifetime of the sandboxed environment, providing a persistent window of opportunity for attackers to harvest credentials without needing to exploit any code execution vulnerabilities within the sandbox itself.
The operational impact of this vulnerability is severe in shared computing environments such as continuous integration runners, multi-tenant developer workstations, and cloud-based build agents. Attackers do not require elevated privileges or access to the spawning user's session; they only need local read access to process information, which is often broadly permitted on development machines. The disclosed data includes host-side API keys, authentication tokens, and other environment secrets that are critical for maintaining system integrity and confidentiality. If an attacker obtains these credentials, they can potentially bypass application-level security controls, access external services, or escalate privileges by leveraging the stolen secrets to authenticate against backend systems. This undermines the principle of least privilege and compromises the trust boundary between isolated microVMs and the host infrastructure.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) regarding the exposure of sensitive data through command lines, though more specifically it maps to CWE-209 Generation of Error Message Containing Sensitive Information if viewed as a leakage vector, and primarily CWE-315 Missing Storage of Password in a Fingerprintable Form or CWE-798 Use of Hard-coded Credentials depending on the source. In terms of offensive security frameworks, this behavior facilitates ATT&CK technique T1003 OS Credential Dumping via /proc filesystem access or T1046 Network Service Discovery if used to map out accessible services using stolen tokens. The vulnerability essentially turns command-line arguments into an unintended side-channel for data exfiltration within the local host context.
To mitigate this risk, organizations and developers must upgrade microsandbox to version 0.5.10 or later where these serialization practices have been corrected. In environments where upgrading is not immediately feasible, it is imperative to restrict access to process information by configuring appropriate file permissions on /proc entries if possible, although this is often difficult due to OS-level constraints. More robustly, applications should avoid passing secrets via command-line arguments entirely. Instead, sensitive data such as API keys and tokens should be passed through environment variables that are not visible in the process table, or better yet, injected into memory securely by the runtime without ever appearing on the command line. Developers should also audit their CI/CD pipelines to ensure that no other tools inadvertently log or expose full command lines containing secrets. Regular auditing of running processes and implementing strict access controls for local user accounts can further reduce the attack surface associated with this class of information disclosure vulnerabilities.