CVE-2026-105570 Docker CVE debrief

Who should care

Defenders and security teams responsible for managing OAuth flows and credential injection in Docker Sandboxes should assess their exposure and update their configurations to prevent potential credential exposure.

Why it matters

CVE-2026-105570 allows untrusted code in Docker Sandboxes to potentially bypass OAuth response masking, exposing host-managed credentials. Defenders should assess their exposure, update configurations, and verify remediation steps.

• Potential exposure of host-managed credentials if a user completes the OAuth flow
• Bypass of OAuth response masking in Docker Sandboxes
• Need for verification of affected versions and remediation steps
• Possible impact on systems using Docker Sandboxes for credential management

Technical summary

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively, while request routing treated DNS hostnames case-insensitively. This discrepancy could allow untrusted code inside a sandbox to bypass response masking by using a case-variant hostname to reach the genuine provider endpoint. Specifically, the case-sensitive comparison of OAuth token-endpoint hostnames could enable an attacker to expose host-managed credentials if a user completes the OAuth flow. The vulnerability highlights the need for consistent hostname comparison methods to prevent potential credential exposure.

Defensive priority

Medium priority for credential management and OAuth flow security assessments

Recommended defensive actions

• Assess and update OAuth flow security configurations in Docker Sandboxes to ensure proper credential management.
• Review and adjust case-sensitivity settings for hostname comparisons in OAuth token-endpoint hostnames.
• Verify and apply vendor-provided patches or updates for Docker Sandboxes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability in Docker Sandboxes. The NVD entry is currently not provided. Evidence from the CVE Program record indicates that the vulnerability allows untrusted code inside a sandbox to potentially expose host-managed credentials if a user completes the OAuth flow. The source item also notes that the issue arises from case-sensitive comparison of OAuth token-endpoint hostnames, while request routing treats DNS hostnames case-insensitively. To verify the vulnerability and assess

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.