CVE-2026-105570

Executive Summary

CVE-2026-105570 is a case-sensitivity mismatch vulnerability (CWE-178) in Docker Sandboxes affecting OAuth token-endpoint hostname validation. The product compared OAuth token-endpoint hostnames case-sensitively when determining whether to mask managed credential responses, while the underlying request routing layer treated DNS hostnames case-insensitively. This discrepancy allows untrusted code running inside a sandbox to craft a case-variant hostname that reaches the genuine OAuth provider endpoint while bypassing response masking, causing access and refresh tokens to be returned unmasked to the sandbox—exposing host-managed credentials. Organizations running Docker Sandboxes with OAuth-based managed credentials are affected; no patch, PoC, or public exploit is currently available.

Technical Analysis

The vulnerability resides at the intersection of two inconsistent parsing behaviors within Docker Sandboxes:

1. Masking decision layer (case-sensitive): When Docker Sandboxes evaluates whether a response originates from a managed OAuth credential provider, it compares the token-endpoint hostname using a case-sensitive comparison. This means Provider.example.com and provider.example.com (and other case variants such as PROVIDER.EXAMPLE.COM) are treated as distinct strings. Only the exact expected casing triggers the credential-masking logic.

2. Request routing layer (case-insensitive): The network request routing component resolves and dispatches requests to DNS hostnames case-insensitively, consistent with RFC 4343, which mandates that DNS name comparisons be case-insensitive. Consequently, a request to a case-variant hostname still reaches the genuine provider endpoint.

The result is a validation/logic mismatch: the routing layer delivers the request to the legitimate OAuth provider, but the masking layer fails to recognize the response as credential-bearing because the hostname casing did not match. The provider's OAuth access token and refresh token are therefore returned to the sandboxed process without masking.

This is a classic canonicalization failure (CWE-178, "Improper Handling of Case Sensitivity"). It does not require a memory-safety exploit, authentication bypass against the provider, or cryptographic break. It exploits differing normalization rules between two software components that must agree on identity semantics. No specific function names, endpoints, or code paths are provided in the source description; the analysis is bounded to the described mechanism of case-sensitivity divergence between routing and response-masking logic.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (case-sensitivity canonicalization mismatch) and the described behavior.

1. Target identification / reconnaissance: An attacker must already have code execution inside a Docker Sandbox (for example, via a malicious dependency, a hijacked build step, or any untrusted code path executed within the sandbox). The attacker identifies that the environment manages OAuth credentials for a known provider and observes or infers the expected token-endpoint hostname.

2. Triggering the flaw class: The attacker initiates a request to the OAuth token endpoint using a case-variant form of the canonical hostname—e.g., altering one or more characters' case in the FQDN. Because routing treats DNS hostnames case-insensitively, the request still reaches the genuine provider endpoint. This is the core canonicalization bypass.

3. Payload / execution method (vulnerability-class level): The attacker drives the OAuth flow—for example, by causing a request to the token endpoint that will return tokens if a user completes authorization. Critically, the case-variant hostname causes the masking decision layer to fail to recognize the response as a managed-credential response. When the user completes the OAuth flow, the provider returns access and refresh tokens, and because masking is bypassed, those tokens are surfaced to the sandbox.

4. Post-exploitation impact: The sandboxed untrusted code now possesses host-managed OAuth access and refresh tokens. The access token grants the provider-defined authorization scope; the refresh token permits long-lived token reissuance even after the access token expires. This enables lateral movement into any service trusting that OAuth provider—potentially including cloud APIs, CI/CD systems, code repositories, or other SaaS integrations. Because the credentials are host-managed, compromise can extend far beyond the sandbox boundary.

Note: The requirement that a user complete the OAuth flow introduces a social-engineering or opportunistic element (user interaction), which is reflected in the require-user-interaction factor of the assessed vector.

Impact Assessment

• Confidentiality (High): OAuth access and refresh tokens are returned unmasked to untrusted sandboxed code. Refresh tokens are especially damaging because they allow persistent credential renewal.
• Integrity (Low/None): The flaw itself does not modify data; however, stolen tokens may be used for authorized—thus integrity-affecting—actions on downstream services.
• Availability (None): No denial-of-service component.
• Scope (Changed): Exploitation crosses a trust boundary from the sandbox into host-managed credential space and potentially into third-party services, expanding beyond the vulnerable component.
• Attack Vector (Network): The token endpoint is reached over the network.
• Attack Complexity (Low): Canonicalization mismatches are deterministic; no race conditions or special conditions are required beyond the case-variant hostname.
• Privileges Required (Low): The attacker needs code execution inside the sandbox.
• User Interaction (Required): A user must complete the OAuth flow for tokens to be issued.
• Business impact: Any organization using Docker Sandboxes to isolate untrusted code while providing OAuth-based managed credentials is exposed. Because the credential is host-managed, a successful attack can yield long-lived provider access, facilitating supply-chain and multi-tenant compromise.

Detection Guidance

Sigma Rule

title: Docker Sandboxes OAuth Token Response Masking Bypass via Case-Variant Hostname
id: 8f1c4b2e-9a7d-4e3f-b6c1-2d5e7f0a1b3c
status: experimental
description: Detects OAuth token-endpoint requests using non-canonical (case-variant) hostnames that may bypass credential response masking in Docker Sandboxes (CVE-2026-105570).
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/docker'
      - '/dockerd'
    CommandLine|contains: 'sandbox'
  selection_oauth:
    CommandLine|contains:
      - 'oauth'
      - 'token'
      - 'refresh_token'
  selection_casevariant:
    CommandLine|re: '(?i)(oauth|token)[^\s]*[A-Z]'
  condition: selection_proc and selection_oauth and selection_casevariant
fields:
  - CommandLine
  - Image
  - User
falsepositives:
  - Legitimate mixed-case hostnames in normal OAuth configuration
level: medium
tags:
  - attack.credential_access
  - attack.t1550
  - cve.2026.105570

YARA Rule

rule CVE_2026_105570_Docker_Sandboxes_OAuth_Case_Masking_Bypass
{
    meta:
        description = "Detects strings indicating OAuth token endpoint handling that may be susceptible to case-sensitivity masking bypass in Docker Sandboxes (CVE-2026-105570)"
        author = "Threat Intelligence"
        reference = "CVE-2026-105570"
        cwe = "CWE-178"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "refresh_token" ascii nocase
        $s2 = "access_token" ascii nocase
        $s3 = "token_endpoint" ascii nocase
        $s4 = "mask" ascii nocase
        $s5 = "sandbox" ascii nocase
        $s6 = "oauth" ascii nocase

    condition:
        uint32(0) != 0 or (2 of ($s1, $s2, $s3)) and 1 of ($s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105570 Docker Sandboxes OAuth Token Endpoint Case-Variant Hostname Masking Bypass Attempt"; flow:established,to_server; http.host; content:"oauth"; nocase; http.host; pcre:"/[A-Z]/"; http.uri; content:"token"; nocase; classtype:credential-theft; reference:cve,2026-105570; sid:2026105570; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name in ("docker", "dockerd") and
     process.command_line : "*sandbox*"]
  [network where network.direction == "egress" and
     process.name in ("docker", "dockerd") and
     network.protocol == "http" and
     wildcard(network.destination.domain, "*[A-Z]*") and
     wildcard(network.destination.domain, "*(oauth OR token)*")]

Splunk SPL Query

index=main (sourcetype=docker:* OR sourcetype=linux:audit)
| search (process_name=docker OR process_name=dockerd) AND command_line="*sandbox*"
| search command_line="*token*" OR command_line="*oauth*" OR command_line="*refresh*"
| regex command_line="(?i)(oauth|token)[^\s]*[A-Z]"
| stats count min(_time) as first_seen max(_time) as last_seen by host process_name command_line user
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="docker,cve-2026-105570,">
  <rule id="105570" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">docker|dockerd</field>
    <field name="process.command_line">sandbox</field>
    <regex field="process.command_line">(?i)(oauth|token|refresh_token)</regex>
    <regex field="process.command_line">[A-Z]</regex>
    <description>CVE-2026-105570: Possible Docker Sandboxes OAuth token masking bypass via case-variant hostname</description>
    <mitre>
      <id>T1550</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Do not run untrusted code in Docker Sandboxes that have host-managed OAuth credentials attached until a fixed version is available.
   • Where feasible, decouple OAuth credentials from sandboxes; use short-lived, narrowly scoped credentials issued outside the sandbox trust boundary.
   • Restrict outbound network egress from sandboxes to an allowlist and normalize (lowercase) hostnames at the egress proxy to defeat case-variant bypass attempts.
   • Rotate any OAuth access and refresh tokens that may have been exposed to sandboxed workloads.
   • Monitor for token-endpoint requests using non-canonical hostname casing.

2. Patch/upgrade steps:

   • Monitor Docker's official security advisories and release channels for a fix addressing CVE-2026-105570.
   • Apply the vendor fix as soon as it is published, and verify that hostname comparisons are normalized (case-insensitive) consistently across both routing and masking logic.
   • No vendor fix is currently available; do not assume that any existing version is remediated.

3. Long-term hardening:

   • Enforce a single canonicalization/normalization policy for DNS hostnames across all components (routing, validation, masking) consistent with RFC 4343.
   • Add unit and integration tests covering case-variant hostnames to prevent regression of this class of bug.
   • Adopt least-privilege OAuth scopes and short token lifetimes for any credential exposed to sandboxed code.
   • Integrate detection rules above into SOC monitoring and conduct credential-exposure tabletop exercises.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-105570
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• RFC 4343 — Domain Name System (DNS) Case Insensitivity Clarification: https://www.rfc-editor.org/rfc/rfc4343
• Docker Security Advisories: https://docs.docker.com/security/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-105570 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-105570. No public PoC, Nuclei template, or exploit code is available at the time of this report.