CVE-2026-105452 Docker CVE debrief

Who should care

Defenders responsible for Docker Sandboxes deployments, particularly those using versions 0.21.0 to 0.42.0, should assess exposure and verify credentials to prevent potential authentication and data exposure.

Why it matters

CVE-2026-105452 allows untrusted code in an authorized Docker Sandboxes instance to supply an unrecognized credential, potentially leading to authentication and data exposure. Defenders should assess exposure, verify credentials, and update to version 0.43.0 or later if available.

• Potential authentication of requests to an attacker-controlled account
• Possible exposure of data included in the request
• Need to verify credential injection and egress proxy configurations
• Requirement to update to version 0.43.0 or later if available

Technical summary

The Docker Sandboxes egress proxy could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, allowing untrusted code in an authorized sandbox to supply an unrecognized credential in another supported authentication header. This vulnerability affects Docker Sandboxes versions 0.21.0 to 0.42.0 and allows untrusted code to potentially authenticate requests to an attacker-controlled account and expose data included in the request.

Defensive priority

Medium priority for defenders to assess exposure and verify credentials

Recommended defensive actions

• Assess exposure by checking if Docker Sandboxes versions 0.21.0 to 0.42.0 are in use
• Verify credential injection and egress proxy configurations
• Monitor for suspicious authentication requests
• Update to version 0.43.0 or later if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions and remediation. Further verification is needed to assess exposure and validate credentials. The vulnerability affects Docker Sandboxes versions 0.21.0 to 0.42.0, and defenders should verify credential injection and egress proxy configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.