Vulnerability · Published Oct 8, 2026 · Assigned by Docker
CVE-2026-105570Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
Medium 6.7
In plain English
A medium-severity security flaw in Docker Sandboxes from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Sandboxes | 0.21.0 – before 0.47.0 |
Weakness: CWE-178 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N