Description (CNA)
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Docker / Docker Sandboxes | affected 0.21.0 before 0.47.0 |
CWE
CWE-636
References
- https://docs.docker.com/ai/sandboxes/
- https://docs.docker.com/ai/sandboxes/configuration/credentials/#how-credential-injection-works
ADP enrichment
No English description supplied.
No references supplied.