Listen to this Post
CVE-2026-61670 is a local information disclosure vulnerability in microsandbox, an easy, fast, local-first microVM runtime and library, affecting versions prior to 0.5.10. When the SDK spawns a sandbox, the `msb sandbox` child process receives the full network configuration as an inline `–network-config /proc/<pid>/cmdline, and on both Linux and macOS they are visible to other local processes via ps. Because the network configuration carries the real secret values used for host-side secret substitution, any unprivileged local user (or any process running as a different user on the same host) can read those secrets directly out of the process listing for as long as the sandbox is running. This defeats the “secrets that can’t leak” guarantee for the host side of the boundary. The SDK serializes the entire NetworkConfig, including the real (non-placeholder) secret values, and pushes it onto the child argv in `sdk/rust/lib/runtime/spawn.rs` near line 1241. The CLI accepts it only as an inline string and parses it with serde_json::from_str, so there is no off-argv channel today. The field is declared at `crates/cli/lib/sandbox_cmd.rs` line 152 and parsed near line 234. The same exposure applies to environment values, which are passed one per argument. Any secret a user places in `env` or in the network config (e.g. upstream API keys used for the host-side proxy substitution) is therefore present in the process command line. The fix and reusable in-repo patterns are tracked, from a readability angle, in issue 997: passing bulky config over an inherited file descriptor (--network-config-fd <n>) the way `–parent-watch-fd` already does removes the values from argv entirely. An env-var alternative does not fully fix this as `/proc/
DailyCVE Form:
Platform: Microsandbox
Version: < 0.5.10
Vulnerability: Argv secret exposure
Severity: Medium (CVSS 6.5)
date: 2026-09-18
Prediction: 2026-06-24
What Undercode Say:
Read secrets from a running msb sandbox process on Linux
cat /proc/$(pgrep -f "msb sandbox")/cmdline | tr '\0' ' ' | grep -oE '--network-config {[^}]}|--env [A-Z_]+=[^ ]+'
Same using ps on Linux or macOS
ps aux | grep "msb sandbox" | grep -oE '--network-config {[^}]}|--env [A-Z_]+=[^ ]+'
// Vulnerable code in sdk/rust/lib/runtime/spawn.rs ~line 1241
let net_json = serde_json::to_string(&config.network)
.expect("failed to serialize network config");
args.push(OsString::from("--network-config"));
args.push(OsString::from(net_json)); // secrets land in argv here
// Environment values passed one per argument (~lines 1249-1251)
for (key, value) in &config.env {
args.push(OsString::from("--env"));
args.push(OsString::from(format!("{key}={value}")));
}
// CLI parsing in crates/cli/lib/sandbox_cmd.rs /// Network configuration as JSON. pub network_config: Option<String>, // line 152 // parsed near line 234 .map(|json| serde_json::from_str::<NetworkConfig>(json).expect(...))
How Exploit: (Educational Purposes!)
Step 1: Launch a sandbox with a secret
msb sandbox run --env API_KEY=supersecret123 --network-config '{"upstream":{"api_key":"realkey"}}' alpine
Step 2: From a separate unprivileged shell on the same host, read the process list
No root, no debugger, no access to spawning user's session required
ps aux | grep "msb sandbox" | grep -oE '--network-config {[^}]}|--env [A-Z_]+=[^ ]+'
Output contains the full --network-config {...} JSON with real secret values
and any --env KEY=VALUE secrets in cleartext
Protection: from this CVE
- Upgrade to microsandbox version 0.5.10 or later.
- Pass bulky config over an inherited file descriptor (
--network-config-fd <n>) the way `–parent-watch-fd` already does (spawn.rslines 207-233,vm::PARENT_WATCH_FD) to remove values from argv entirely. - Do not rely on environment variables as an alternative, as `/proc/
/environ` is still readable by the same uid and root and is inherited by children. - Use an fd or reference handoff as the appropriate channel for secret material.
Impact:
Local information disclosure of secrets (CWE-214: invocation of process using visible sensitive information / CWE-200). Any local user or co-resident process on the host running a microsandbox can read credentials that were meant to stay host-side and never reach untrusted code. This is most serious on shared or multi-tenant hosts, CI runners, and developer machines running other untrusted tooling, where the threat model explicitly assumes the secret never leaves the trusted host boundary. The vulnerability does not require code execution inside the sandbox; it is exploitable purely from the host’s process table.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
