CVE-2026-78122: docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of docker-socket-proxy through 0.5.0 are exposed when the CONTAINERS environment variable is set. The affected access-control issue applies to read endpoints in the Docker API /containers namespace.
What does an attacker need to exploit this?
An attacker needs network access to the docker-socket-proxy service and does not need privileges or user interaction. They can send GET requests to affected /containers endpoints.
What information can be accessed?
An attacker can read arbitrary files through /containers/{id}/archive and download complete container filesystems as tar archives through /containers/{id}/export. Container logs and process information may also be read through the affected logs and top endpoints.