« Volver al listado

CVE-2026-61670

Estado: AplazadaMedia (6.5)—

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox.

Leer descripción completaMostrar menos

Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L con PR:L permite escalada local (T1068). Exposición de secretos en línea de comandos via /proc (T1552.001) y acceso a datos de host (T1005) sin requerir ejecución en sandbox.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPassword PoliciesExecution PreventionAudit

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microsandbox — MicrosandboxAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-61670",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61670",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-21T19:40:17.339147Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "superradcompany",
          "product": "microsandbox",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.5.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-18T21:17:01.973",
  "references": [
    {
      "url": "https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/superradcompany/microsandbox/issues/997",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/superradcompany/microsandbox/pull/1006",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-214"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10."
    }
  ],
  "lastModified": "2026-09-24T21:25:27.050",
  "sourceIdentifier": "security-advisories@github.com"
}