CVE-2026-78122 Tecnativa CVE debrief

Who should care

Container administrators and security teams should assess exposure and verify patching for docker-socket-proxy to prevent unauthorized access to container filesystems. They should also implement additional access controls for container filesystems to limit potential damage and monitor container logs for suspicious activity to detect potential exploitation attempts.

Why it matters

CVE-2026-78122 allows attackers to read arbitrary files and download entire container filesystems as tar archives. Container administrators and security teams should assess exposure and verify patching for docker-socket-proxy.

• Verify patching for docker-socket-proxy to prevent unauthorized access to container filesystems.
• Implement additional access controls for container filesystems to limit potential damage.
• Monitor container logs for suspicious activity to detect potential exploitation attempts.

Technical summary

The docker-socket-proxy vulnerability allows attackers to read arbitrary files and download entire container filesystems as tar archives using GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top when the CONTAINERS environment variable is set. This vulnerability affects container administrators and security teams, who should assess exposure and verify patching for docker-socket-proxy to prevent unauthorized access to container filesystems. The vulnerability has a CVSS score of 8.3 and a severity of HIGH.

Defensive priority

Container administrators and security teams should assess exposure and verify patching for docker-socket-proxy.

Recommended defensive actions

• Verify patching for docker-socket-proxy
• Restrict access to the Docker API
• Monitor container logs for suspicious activity
• Implement additional access controls for container filesystems
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description states that docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.