IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.7Orta

CVE-2026-12039Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution

Docker Docker Sandboxes Yayım: (4 ay önce)

Açıklama

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.

Zayıflık türü (CWE): CWE-923

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Docker Docker Sandboxes 0.13.0 – < 0.33.0

Kaynaklar ve yamalar

Aynı üründe son açıklar — Docker / Moby

5.7Orta
CVE-2026-123082

Docker Desktop logs can expose the Docker Hub access token

Docker Docker Desktop

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker D…

6.7Orta
CVE-2026-121522

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.