CVE-2026-101998

MediumCVSS 5.9/10Last modified Oct 8, 2026

Description

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.

Metrics

CVSS 4.0 5.9/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-636

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Docker	Docker Sandboxes	>= 0.21.0, < 0.47.0

References

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1019996.5A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a den CVE-2026-102005.3A vulnerability was found in Assimp up to 6.0.4. This affects the function glTFCommon::CopyValue in the library glTFCommon.h of the componen CVE-2026-1020006.5A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacke CVE-2026-1020023.1The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exp CVE-2026-1020047.8Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. CVE-2026-1020055.5Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific ser CVE-2026-1020065.5In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly re CVE-2026-1020077.2The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cro CVE-2026-102013.3A vulnerability was determined in Assimp up to 6.0.4. This vulnerability affects the function FBXExporter::WriteObjects of the file FBXExpor CVE-2026-1020107.0A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocat CVE-2026-1020116.5A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a den CVE-2026-1020127.5A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to