CVE-2026-105570

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.

• CWE-178

• https://docs.docker.com/ai/sandboxes/
• https://docs.docker.com/ai/sandboxes/configuration/credentials/#how-credential-injection-works

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10550A weakness has been identified in elunez eladmin up to 2.7. …6.3
• CVE-2026-10551The Breeze Cache WordPress plugin before 2.5.6 is vulnerable…6.1
• CVE-2026-10552The Blue Captcha plugin for WordPress is vulnerable to Cross…4.3
• CVE-2026-10553The jQuery Hover Footnotes plugin for WordPress is vulnerabl…4.3
• CVE-2026-10556Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7…5.3
• CVE-2026-10557The Yarbo Android and iOS applications contain hard-coded MQ…9.8
• CVE-2026-105571A flaw has been found in PickMall Lilishop up to 4.2.4. The …7.3
• CVE-2026-105572A vulnerability has been found in PickMall Lilishop up to 4.…4.3
• CVE-2026-105573A vulnerability was found in newbee-ltd newbee-mall up to 2.…4.3
• CVE-2026-10558A vulnerability was detected in SourceCodester Pizzafy Ecomm…6.3
• CVE-2026-10559A flaw has been found in SourceCodester Pizzafy Ecommerce Sy…6.3
• CVE-2026-105591Heap-based buffer overflow in Microsoft Office Access allows…8.8