Docker Sandboxes up to 0.32.x DNS Resolution communication channel to intended endpoints

Summaryinfo

A vulnerability classified as problematic was found in Docker Sandboxes up to 0.32.x. Affected by this vulnerability is an unknown functionality of the component DNS Resolution Handler. Such manipulation leads to communication channel to intended endpoints. This vulnerability is listed as CVE-2026-12039. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Docker Sandboxes up to 0.32.x and classified as problematic. Affected by this issue is an unknown function of the component DNS Resolution Handler. The manipulation with an unknown input leads to a communication channel to intended endpoints vulnerability. Using CWE to declare the problem leads to CWE-923. The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. Impacted is confidentiality. CVE summarizes:

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.

The weakness was presented by Sophie Lemos. The advisory is available at docs.docker.com. This vulnerability is handled as CVE-2026-12039 since 06/11/2026. The exploitation is known to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available.

Upgrading to version 0.33.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Docker

Name

• Sandboxes

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion