CVE-2026-101998

Executive Summary

CVE-2026-101998 is a fail-open credential-exposure flaw (CWE-636, "Not Failing Securely") in Docker Sandboxes. When a protected proxy handler reads a response body and that read returns data together with an error, affected handlers can forward unmasked response bytes instead of failing closed and blocking the response. Because the proxy is responsible for masking host-managed secrets, code running inside an authorized sandbox can recover OAuth access tokens, OAuth refresh tokens, or a derived Anthropic API key that were intended to remain outside the sandbox boundary.

Technical Analysis

The vulnerability class is CWE-636 — Not Failing Securely ("fail open"). The affected component is the Docker Sandboxes protected proxy responsible for masking credentials in proxied responses. The core defect is a control-flow error in the response-body handling path: a body read that returns both data and an error is treated as a partial success rather than as a failure condition. In a correctly hardened implementation, any error during a masking/redaction operation must abort the response and never emit raw bytes. Here, the handler forwards the unmasked bytes that accompanied the error, meaning the masking step is effectively bypassed for that response.

The secret material at risk is explicitly enumerated in the advisory: host-managed OAuth access tokens, OAuth refresh tokens, and a derived Anthropic API key. These are described as being intended to remain outside the sandbox, confirming that the proxy is a security boundary control — a credential-injection/masking broker that lets sandboxed workloads use credentialed upstream services without ever holding the underlying secrets. The trust model is therefore broken at the exact point where it matters: a compromised or merely curious workload that already has authorized sandbox access can escalate from "can call the proxy" to "can read the proxy's secrets."

Three properties make this a notable boundary failure rather than a simple bug. First, no authentication bypass is required — the attacker operates from inside an already authorized sandbox, so the only precondition is the ability to run code in the sandbox and to influence or observe proxy response handling. Second, the trigger condition is an error path, which is exactly the condition an attacker can attempt to induce (e.g., via malformed upstream responses or timing/connection disruptions) and which is also reachable accidentally, meaning exposure may occur without deliberate manipulation. Third, the leaked material is long-lived: OAuth refresh tokens allow repeated minting of new access tokens, and API keys are typically valid until rotated.

No CVE-assigned CVSS score, vector, CWE-derived subscore breakdown, EPSS value, affected version range, or patch reference is available from tracked sources, so quantitative severity assessment cannot be performed from supplied data. Exploit code, public PoCs, and Nuclei templates are all absent. This should not be read as evidence of low risk — an unpatched credential-disclosure flaw on a security-boundary component is operationally serious regardless of missing score metadata.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (fail-open on error during credential masking) and the advisory's stated impact.

1. Preconditions and access. The attacker needs the ability to execute code within a sandbox that is already authorized to use the protected proxy. This is the standard operating condition of a sandbox — for example, a developer running untrusted or third-party code, a compromised dependency executing during a build, or a malicious instruction followed by an agent operating inside the sandbox. No external network position or pre-existing host compromise is described as necessary.

2. Triggering the fail-open path. The attacker causes a proxied response body read against a credential-bearing request to return data together with an error. At the vulnerability-class level this means inducing or waiting for an error condition in the response-body handling path — for instance an interrupted or truncated upstream exchange, a malformed response, or any condition that makes the read return partial content alongside an error. The defining behavior is that the handler does not abort; it forwards the bytes it received.

3. Recovering the secret. Because the masking step was skipped for that response, the forwarded bytes contain the unmasked credential — an OAuth access token, an OAuth refresh token, or the derived Anthropic API key. The in-sandbox code simply reads and stores the response. No decoding, cryptographic attack, or memory-corruption primitive is involved; the flaw is a logic/control-flow failure, so exploitation is a matter of observability rather than exploit development.

4. Post-exploitation. With an access token the attacker can impersonate the sandbox's authorized identity against the upstream provider for the token's lifetime. With a refresh token, the attacker can mint fresh access tokens at will and persist access independently of the original session. With the Anthropic API key, the attacker obtains direct billable API access to the associated account and any data or tooling reachable through it. Because the stolen material originated from the host, leakage escapes the sandbox boundary that the proxy was designed to enforce.

Reliability caveat. Since the trigger is an error-dependent path, exploitation is opportunistic rather than deterministic from the description alone. Attempts may need to be repeated or combined with induced error conditions, and the window in which a given response is unmasked is not characterized in available data.

Impact Assessment

Impact is confidentiality-only credential compromise at a trust boundary. The primary affected asset is the sandbox credential broker and, transitively, every upstream service whose tokens are brokered through it — OAuth-protected resources and the Anthropic API account behind the derived key.

Blast radius considerations:

• Sandbox-to-host escalation. The vulnerability defeats the sandbox's purpose as a containment boundary. A workload that should have been unable to possess host-managed secrets can obtain them, converting a contained compromise into a host-level credential compromise.
• Multi-tenant and shared-host risk. Any environment where multiple sandboxes, workloads, or users share a host proxy is exposed: one sandbox's error-path leak can disclose credentials that are authorized for other contexts.
• Token longevity. Refresh tokens and API keys have long validity windows. Detection is complicated because the stolen credential is a legitimate credential used from an unusual location, not a malicious artifact.
• Downstream financial and data exposure. API key theft carries direct billing exposure plus potential access to whatever data or model interactions the key authorizes.

CVSS severity cannot be stated: the supplied data reports CVSS as N/A with no vector and no published subscores, and no EPSS value has been assigned by FIRST.org. Any numeric severity claim would be fabricated. Operationally, the combination of unpatched status (patch confidence 0/4), no workaround documented, no affected-version range to scope exposure, and a credential-theft outcome warrants high urgency for any organization running Docker Sandboxes.

Detection Guidance

Detection strategy: the vulnerability itself produces no distinctive network signature, so detection focuses on (a) anomalous use of brokered credentials from outside their expected origin, (b) proxy error responses that contain credential material, and (c) sandbox processes reading credential-shaped content.

Sigma Rule

title: Docker Sandbox Proxy Error Forwarding Unmasked Credential Response
id: 8f3c1d20-5b47-4a91-9e6c-1d2a7b0e4c11
status: experimental
description: Detects protected-proxy error conditions where response bytes are forwarded on a failed body read, potentially exposing host-managed OAuth tokens or a derived Anthropic API key.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101998
author: valtersit.com
date: 2026/01/01
logsource:
  product: docker
  service: sandbox
detection:
  selection_proxy:
    service|contains:
      - 'sandbox'
      - 'proxy'
  selection_error:
    - 'body read error'
    - 'partial response'
    - 'read returned data with error'
    - 'unexpected EOF'
  selection_forward:
    - 'forwarding'
    - 'masking skipped'
    - 'unmasked'
  condition: selection_proxy and selection_error and selection_forward
falsepositives:
  - Benign transient upstream read errors that do not carry credential material
level: high
tags:
  - attack.credential_access
  - attack.t1552

YARA Rule

rule CVE_2026_101998_Docker_Sandbox_Credential_Masking_FailOpen
{
    meta:
        description = "Detects sandbox/proxy handler code with a fail-open body-read path where data is used despite a read error during credential masking"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101998"
        cve = "CVE-2026-101998"
        date = "2026-01-01"

    strings:
        $proxy  = "sandbox" ascii wide nocase
        $mask1  = "mask" ascii wide nocase
        $mask2  = "redact" ascii wide nocase
        $tok1   = "access_token" ascii wide nocase
        $tok2   = "refresh_token" ascii wide nocase
        $key    = "anthropic" ascii wide nocase
        $err1   = "err != nil" ascii wide
        $err2   = "error != nil" ascii wide
        $err3   = "except" ascii wide

    condition:
        filesize < 5MB and
        $proxy and
        ($mask1 or $mask2) and
        ($tok1 or $tok2 or $key) and
        ($err1 or $err2 or $err3)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-101998 Docker Sandbox Proxy Possible Unmasked Credential Egress in Response Body"; flow:established,to_client; http.response_body; content:"access_token"; nocase; content:"refresh_token"; nocase; distance:0; within:4096; threshold:type limit, track by_src, count 1, seconds 60; classtype:policy-violation; metadata:cve CVE-2026-101998; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101998; sid:2026101998; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-101998 Docker Sandbox Proxy Anthropic Key Leak Attempt"; flow:established,to_client; http.response_body; content:"anthropic-", nocase; content:"api"; nocase; distance:0; within:64; threshold:type limit, track by_src, count 1, seconds 60; classtype:policy-violation; metadata:cve CVE-2026-101998; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101998; sid:2026101999; rev:1;)

Note: these signatures target the symptom (credential-shaped material crossing the sandbox egress boundary) because the masking flaw is an internal logic error with no protocol-level fingerprint of its own.

Elastic Detection

sequence by host.id with maxspan=2m
  [process where process.name != null and
     process.command_line : ("*sandbox*" or "*docker-proxy*") and
     event.action == "start"]
  [network where
     network.direction == "egress" and
     (network.protocol == "http" or network.protocol == "https") and
     process.parent.name : ("*docker*" or "*sandbox*")]

For hosts where response bodies are logged or inspected, complement with a credential-shape match:

any where event.category == "network" and
  event.action == "response" and
  (stringContains(network.response_body, "access_token") or
   stringContains(network.response_body, "refresh_token") or
   stringContains(network.response_body, "anthropic")) and
  process.name : ("*proxy*" or "*sandbox*")

Splunk SPL Query

index=docker OR index=proxy (source="*sandbox*" OR source="*proxy*")
( "body read" OR "read error" OR "partial response" OR "unexpected EOF" )
| eval cred_exposed=if(match(_raw,"(?i)access_token|refresh_token|anthropic[-_]?api"),1,0)
| where cred_exposed=1 OR match(_raw,"(?i)masking skipped|unmasked|fail(ed)? open")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(user) as users by source, sourcetype
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="docker,sandbox,credential_access,">
  <rule id="101998" level="12">
    <decoded_as>json</decoded_as>
    <field name="service">sandbox|proxy</field>
    <field name="message" type="pcre2">(?i)(body read error|partial response|unexpected EOF)</field>
    <field name="message" type="pcre2">(?i)(access_token|refresh_token|anthropic)</field>
    <description>CVE-2026-101998: Docker Sandbox proxy may have forwarded unmasked credential response</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>

  <rule id="101999" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">sandbox|proxy</field>
    <field name="message" type="pcre2">(?i)(masking skipped|unmasked|failed to mask)</field>
    <description>CVE-2026-101998: credential masking step skipped in sandbox proxy response path</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is documented, no workaround is published, and no affected version range is available to scope exposure.

1. Immediate mitigations (compensating controls, not fixes).

   • Treat all credentials brokered through Docker Sandboxes as potentially compromised and initiate rotation of OAuth access tokens, OAuth refresh tokens, and the derived Anthropic API key. Rotate refresh tokens and API keys first, since they enable persistence.
   • Reduce the lifetime of any brokered credentials to the minimum workable window so that leaked material expires quickly.
   • Restrict which upstream services and scopes the proxy is authorized to broker; remove any credentials not strictly required by sandboxed workloads.
   • Limit sandbox egress so that a sandbox cannot reach credential-bearing upstream endpoints except through the proxy, and monitor for credential-shaped data leaving the sandbox boundary.
   • Where the design allows, stop brokering long-lived secrets (refresh tokens, API keys) into the proxy path and prefer short-lived, narrowly scoped, per-session tokens.
   • Isolate sandboxes by trust level so that a leak in one context cannot disclose credentials authorized for another.

2. Patch/upgrade steps.

   • No fixed version is identified in available data. Monitor the Docker advisory channel and NVD for CVE-2026-101998 for a patched release and an affected-version range.
   • Once a fixed version is published, upgrade Docker Sandboxes immediately and verify that the body-read error path now fails closed (aborts the response and never forwards bytes on any read error).
   • Re-validate the masking control after upgrade with a deliberate error-injection test to confirm no unmasked bytes are emitted.

3. Long-term hardening.

   • Enforce a fail-closed design principle for all security-control paths: any error in a masking, redaction, or filtering operation must abort the response rather than degrade to passthrough. Add this as an explicit code-review and test invariant.
   • Add unit and integration tests that force body-read-returns-data-with-error conditions and assert that no unmasked bytes are ever forwarded.
   • Adopt deny-by-default proxy behavior: if masking cannot be confirmed complete, the response is dropped.
   • Instrument the proxy to log and alert on any error-path response that still contains candidate secret material, treating such events as security incidents.

References

1. NVD — CVE-2026-101998: https://nvd.nist.gov/vuln/detail/CVE-2026-101998
2. CWE-636 — Not Failing Securely ("Failing Open"): https://cwe.mitre.org/data/definitions/636.html
3. MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
4. Docker Security Advisories (monitor for the CVE-2026-101998 fixed release and affected version range): https://docs.docker.com/security/
5. FIRST.org EPSS (no score assigned for this CVE as of this report): https://www.first.org/epss/

No threat actor campaigns and no exploit-in-the-wild evidence are documented for this CVE in the supplied data. CISA KEV status: not listed. No public PoC, exploit code, or Nuclei template is available; exploitation mechanics described above are inferred from the vulnerability class (CWE-636) and the advisory's stated credential-exposure impact.