CVE-2026-12039

Katalog CVE

CVSS 5.7 · Medium EPSS 0,10%

Kerentanan Improper Restriction of Communication Channel to Intended Endpoints. Skor CVSS 4.0 5.7 (Medium) menurut docker.com.

Deskripsi (NVD)

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Awaiting Analysis

CVSS 4.0

5.7 (Medium), sumber docker.com
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://docs.docker.com/ai/sandboxes/
• https://github.com/docker/sbx-releases/releases/tag/v0.33.0