CVE-2026-109441: LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge
LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing requireworkspaceowner checks to read files such as vault secrets from exposed servers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments that run multiple tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled are exposed. A single-tenant deployment would not have another tenant's sandbox to target.
What does an attacker need to exploit it?
The attacker needs an authenticated account and the ability to execute code in their own sandbox. Exploitation also requires interacting with a target tenant's container; user interaction is required according to the supplied vector.
What could an attacker access?
An attacker may connect directly to other tenants' containers and bypass require_workspace_owner checks. The described impact includes reading files exposed by services in those containers, such as vault secrets.
What can be done if patching is not immediately possible?
The provided data identifies the shared default Docker bridge and enabled inter-container communication as the exposure conditions. Isolate tenant sandbox containers from one another rather than placing them on a shared network with direct inter-container connectivity.