EUVD-2026-37892
GHSA-4crj-qc6g-g3xj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low sandbox privileges required; AC:L since DNS query issuance is trivial; C:H for arbitrary data exfiltration; no integrity or availability impact; scope unchanged as impact is on the sandbox workload's own data.
Primary rating from Vendor (docker).
CVSS VectorVendor: docker
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.
AnalysisAI
DNS covert-channel exfiltration in Docker Sandboxes (sbx) prior to v0.33.0 allows untrusted workloads executing inside internet-connected sandboxes to bypass the configured HTTP/S-only egress allowlist by encoding data into DNS subdomain labels. The per-network embedded DNS resolver forwards all queried names to the host resolver without consulting egress policy, undermining the core isolation guarantee that sbx provides for AI agent workloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete conditions explicitly stated in the description: (1) the sandbox must be configured with an internet-connected network mode - sandboxes operating in air-gapped or offline network configurations are not affected because the DNS forwarding path to the host resolver does not exist; (2) the attacker must have low-privilege code execution inside the sandbox (PR:L per the CVSS 4.0 vector), consistent with being an untrusted workload or a compromised AI agent process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) yields a score of 5.7 - moderate - reflecting local attack vector, low-privilege requirement, a specific attack condition (internet-connected network mode, AT:P), and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised AI agent workload executing inside an internet-connected sbx sandbox reads sensitive values from the process environment or mounted workspace - such as API tokens or private key material - and encodes them as base32 subdomains of an attacker-controlled domain (e.g., data-chunk.exfil.attacker.com). The embedded DNS server, receiving the lookup, forwards it to the host resolver and onward to the attacker's authoritative DNS, where each query is logged server-side, reconstructing the exfiltrated payload. … |
| Remediation | Upgrade Docker Sandboxes (sbx) to v0.33.0 or later, which gates DNS resolution on the configured egress policy, closing the DNS exfiltration channel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today