{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/tecnativa/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-78122"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["docker-socket-proxy"],"_cs_severities":["high"],"_cs_tags":["vulnerability","container-security","api-security"],"_cs_type":"advisory","_cs_vendors":["Tecnativa"],"content_html":"\u003cp\u003eTecnativa docker-socket-proxy version 0.5.0 and earlier contains an access control vulnerability identified as CVE-2026-78122. The vulnerability arises when the 'CONTAINERS' environment variable is enabled, intended to gate access to specific Docker API endpoints. Due to insufficient granularity in the HAPROXY configuration, the proxy fails to properly restrict read-only endpoints in the /containers namespace. An unauthenticated attacker positioned on the adjacent network can issue GET requests to sensitive endpoints, including /containers/{id}/archive and /containers/{id}/export. Successful exploitation allows the attacker to download entire container filesystems as tar archives, read container logs, and inspect process information via /top. This vulnerability poses a significant risk to environments relying on the proxy to isolate the Docker socket from unauthorized network entities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability includes the unauthorized disclosure of sensitive data contained within running container filesystems. Successful exploitation enables attackers to extract configuration files, environment variables, source code, and secrets present in the container images. This could lead to further compromise of the underlying infrastructure or linked services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a version of docker-socket-proxy that resolves the configuration flaw in the HAPROXY ruleset.\u003c/li\u003e\n\u003cli\u003eReview and tighten the HAPROXY access control lists (ACLs) to ensure only authorized endpoints are reachable, explicitly denying access to /archive and /export unless strictly required.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unauthorized GET requests to the /containers API namespace originating from untrusted network segments.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the docker-socket-proxy service to only explicitly authorized client IPs using firewall or network security group rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T23:33:32Z","date_published":"2026-08-22T23:33:32Z","id":"https://feed.craftedsignal.io/briefs/2026-08-docker-socket-proxy-auth-bypass/","summary":"An access control vulnerability in docker-socket-proxy (CVE-2026-78122) allows unauthenticated adjacent attackers to bypass restrictions and exfiltrate container filesystems via unauthorized API requests.","title":"Insufficient Access Control in docker-socket-proxy","url":"https://feed.craftedsignal.io/briefs/2026-08-docker-socket-proxy-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Tecnativa","version":"https://jsonfeed.org/version/1.1"}