CVE-2026-78122

Received Received - Intake

docker-socket-proxy Unauthorized File Read via Docker API Endpoints

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-22

Generated

2026-08-23

AI Q&A

2026-08-23

EPSS Evaluated

N/A

NVD

CVE-2026-78122

EUVD

EUVD-2026-64603

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1220	The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

Executive Summary

docker-socket-proxy does not properly restrict read access to certain Docker API endpoints when the CONTAINERS environment variable is set. This allows attackers to send GET requests to endpoints like /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read files or download entire container filesystems.

Detection Guidance

Check if docker-socket-proxy is running with the CONTAINERS environment variable set. Inspect network traffic for GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, or /containers/{id}/top endpoints.

Impact Analysis

An attacker could exploit this to access sensitive data stored in containers, such as configuration files, logs, or other confidential information. This could lead to data breaches, unauthorized access to systems, or further compromise of the Docker environment.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Disable the CONTAINERS environment variable in docker-socket-proxy. Restrict access to the Docker socket. Update docker-socket-proxy to a patched version if available.

Hi! I’m here to help you understand CVE-2026-78122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70