Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2026-105570: Docker Sandboxes may expose OAuth tokens to sandbox code
CVE-2026-105570 · published 27 days ago
Summary
Docker Sandboxes can be tricked into sending OAuth access and refresh tokens back to untrusted code inside the sandbox. This happens because the system checks the server name in a case‑sensitive way but routes traffic without regard to case, allowing a differently capitalized hostname to bypass the masking protection. Update Docker to the latest version or apply the vendor’s recommended configuration to prevent this bypass.
What to do
- Update docker docker sandboxes to version 0.47.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| docker | docker sandboxes | < 0.47.0 |
Original advisory text
Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-178Improper Handling of Case Sensitivity
Timeline
Published8 Oct 2026
Updated26 Oct 2026
First seen8 Oct 2026
Track software like this
Free during beta