Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck

CVE-2026-78122docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

High 7.4

In plain English

A high-severity security flaw in docker-socket-proxy from Tecnativa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

Affected products (as reported)

Vendor	Product	Versions
Tecnativa	docker-socket-proxy	0 – through 0.5.0

Weakness: CWE-1220 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

GitHub Issue #182 issue-tracking
https://github.com/Tecnativa/docker-socket-proxy product
https://github.com/Tecnativa/docker-socket-proxy/blob/v0.5.0/haproxy.cfg#L49-L61 technical-description
https://github.com/Tecnativa/docker-socket-proxy/pull/183 issue-tracking, patch
https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732 exploit
VulnCheck Advisory: docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems third-party-advisory