VulnerabilityAwaiting Analysis

CVE-2026-105452

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy.

MEDIUM 5.9EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in another supported authentication header. For affected upstream services, this could authenticate the request to an attacker-controlled account and expose data included in the request.

CVSS 4.0: 5.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.14% probability · 4th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-200
Source: security@docker.com

EPSS trend

EPSS moved from 0.1% on 9 October 2026 to 0.1% on 26 October 2026.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.