CVE-2026-12039

Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist.

CVSS

No CVSS.

References

Link	Resource
https://docs.docker.com/ai/sandboxes/
https://github.com/docker/sbx-releases/releases/tag/v0.33.0

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Docker Sandboxes (sbx) impone una lista blanca de egreso solo para HTTP/S, pero no la aplica a la resolución DNS: el servidor DNS integrado por red reenvía cualquier nombre consultado al resolvedor del host siempre que la red esté conectada a internet, sin consultar la política. Una carga de trabajo dentro de una sandbox, que el modelo de amenaza trata como no confiable, puede, por lo tanto, codificar datos en etiquetas DNS para un dominio controlado por un atacante y exfiltrarlos a través de un canal encubierto DNS, eludiendo la lista blanca configurada.

Information

Published : 2026-06-18 14:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-12039

Mitre link : CVE-2026-12039

CVE.ORG link : CVE-2026-12039

JSON object : View

Products Affected

No product.

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

{"id": "CVE-2026-12039", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12039", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T15:00:00.773890Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@docker.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@docker.com", "affectedData": [{"cpes": ["cpe:2.3:a:docker:docker_sandboxes:*:*:*:*:*:*:*:*"], "vendor": "Docker", "product": "Docker Sandboxes", "versions": [{"status": "affected", "version": "0.13.0", "lessThan": "0.33.0", "versionType": "semver"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-06-18T14:17:20.780", "references": [{"url": "https://docs.docker.com/ai/sandboxes/", "source": "security@docker.com"}, {"url": "https://github.com/docker/sbx-releases/releases/tag/v0.33.0", "source": "security@docker.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@docker.com", "description": [{"lang": "en", "value": "CWE-923"}]}], "descriptions": [{"lang": "en", "value": "Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist."}, {"lang": "es", "value": "Docker Sandboxes (sbx) impone una lista blanca de egreso solo para HTTP/S, pero no la aplica a la resoluci\u00f3n DNS: el servidor DNS integrado por red reenv\u00eda cualquier nombre consultado al resolvedor del host siempre que la red est\u00e9 conectada a internet, sin consultar la pol\u00edtica. Una carga de trabajo dentro de una sandbox, que el modelo de amenaza trata como no confiable, puede, por lo tanto, codificar datos en etiquetas DNS para un dominio controlado por un atacante y exfiltrarlos a trav\u00e9s de un canal encubierto DNS, eludiendo la lista blanca configurada."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security@docker.com"}