Insufficient Access Control in docker-socket-proxy

Tecnativa docker-socket-proxy version 0.5.0 and earlier contains an access control vulnerability identified as CVE-2026-78122. The vulnerability arises when the 'CONTAINERS' environment variable is enabled, intended to gate access to specific Docker API endpoints. Due to insufficient granularity in the HAPROXY configuration, the proxy fails to properly restrict read-only endpoints in the /containers namespace. An unauthenticated attacker positioned on the adjacent network can issue GET requests to sensitive endpoints, including /containers/{id}/archive and /containers/{id}/export. Successful exploitation allows the attacker to download entire container filesystems as tar archives, read container logs, and inspect process information via /top. This vulnerability poses a significant risk to environments relying on the proxy to isolate the Docker socket from unauthorized network entities.

Impact

The impact of this vulnerability includes the unauthorized disclosure of sensitive data contained within running container filesystems. Successful exploitation enables attackers to extract configuration files, environment variables, source code, and secrets present in the container images. This could lead to further compromise of the underlying infrastructure or linked services.

Recommendation

• Upgrade to a version of docker-socket-proxy that resolves the configuration flaw in the HAPROXY ruleset.
• Review and tighten the HAPROXY access control lists (ACLs) to ensure only authorized endpoints are reachable, explicitly denying access to /archive and /export unless strictly required.
• Monitor logs for unauthorized GET requests to the /containers API namespace originating from untrusted network segments.
• Restrict network access to the docker-socket-proxy service to only explicitly authorized client IPs using firewall or network security group rules.