EUVD-2026-37892
GHSA-4crj-qc6g-g3xj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low sandbox privileges required; AC:L since DNS query issuance is trivial; C:H for arbitrary data exfiltration; no integrity or availability impact; scope unchanged as impact is on the sandbox workload's own data.
Primary rating from Vendor (docker).
CVSS VectorVendor: docker
Lifecycle Timeline
3DescriptionCVE.org
Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.
AnalysisAI
DNS covert-channel exfiltration in Docker Sandboxes (sbx) prior to v0.33.0 allows untrusted workloads executing inside internet-connected sandboxes to bypass the configured HTTP/S-only egress allowlist by encoding data into DNS subdomain labels. The per-network embedded DNS resolver forwards all queried names to the host resolver without consulting egress policy, undermining the core isolation guarantee that sbx provides for AI agent workloads. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector assigns high confidentiality impact (VC:H), consistent with the ability to exfiltrate arbitrary in-sandbox data - including API keys, environment variables, and workspace secrets - to an attacker-controlled authoritative DNS server.
Technical ContextAI
Docker Sandboxes (sbx) is Docker's AI workload isolation product that runs untrusted agent processes (e.g., Claude, Codex) inside network-isolated containers governed by an HTTP/S egress allowlist enforced via a MITM proxy. The root cause is CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints): the allowlist enforcement mechanism operates exclusively at the HTTP/S proxy layer and has no visibility into DNS traffic, which transits over UDP/TCP port 53 as a structurally separate channel. The per-network embedded DNS server - responsible for resolving names inside the sandbox - forwards all queries unconditionally to the host resolver when the sandbox network is internet-connected, without first consulting the egress policy. DNS covert channels exploit this by encoding payloads as base32 or hex subdomains of an attacker-controlled domain; each lookup causes the DNS server to relay the encoded data outward to the authoritative resolver. No CPE strings were provided, but the affected scope is all sbx releases prior to v0.33.0. The fix in v0.33.0 introduces policy gating on DNS resolution, ensuring sandboxed processes cannot resolve domains outside the permitted allowlist.
RemediationAI
Upgrade Docker Sandboxes (sbx) to v0.33.0 or later, which gates DNS resolution on the configured egress policy, closing the DNS exfiltration channel. The patched release is available at https://github.com/docker/sbx-releases/releases/tag/v0.33.0. As a compensating control prior to patching, configure sandboxes with air-gapped or offline-only network modes to prevent the embedded DNS server from forwarding queries to the host resolver; this eliminates internet connectivity for the workload, which may conflict with agent functionality that requires external API access. A secondary compensating control is deploying a Response Policy Zone (RPZ) or DNS firewall at the host resolver level to block resolution of unauthorized domains; this reduces exfiltration scope but does not close the channel for permitted domains and adds resolver management overhead. Note that v0.33.0 also patches ICMP egress leakage across daemon restarts and adds CRL publication to the MITM proxy - both represent additional hardening beyond the DNS fix.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today