{"id":"CVE-2026-109441","kind":"vulnerability","aliases":["CVE-2026-109441"],"related":[],"title":"LangAlpha: shared Docker bridge lets tenants reach each other's sandboxes","description":"LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.","summary":"LangAlpha places every tenant's sandbox container on Docker's shared default bridge network with inter-container communication enabled. An authenticated user who can run code in their own sandbox can connect to other tenants' containers and read their files, including vault secrets.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","docker","langalpha","multi-tenant","self-hosted"],"not_affected_if":["isolated-sandbox-networks","single-tenant"],"how_to_check":"- Check whether sandbox containers share the default `bridge` network, for example with `docker network inspect bridge` and looking for the sandbox containers.\n- Confirm whether inter-container communication is enabled on that bridge (`com.docker.network.bridge.enable_icc` set to true or unset).\n- unknown for any other LangAlpha-specific setting the sources do not name.","fix":"- LangAlpha: unknown. The sources do not name a fixed version; the advisory covers all releases through `2026.09.07`.\n- Until a fix is confirmed, isolate sandbox containers on per-tenant networks and disable inter-container communication on the shared bridge.\n- Rotate any vault secrets that sandbox containers could have read.","status":"open","published_at":"2026-10-20T01:17:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:40:41+00:00","updated_at":"2026-10-25T03:40:41+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:40:41Z","model":"claude-haiku-5-5","output":{"fix":"- LangAlpha: unknown. The sources do not name a fixed version; the advisory covers all releases through `2026.09.07`.\n- Until a fix is confirmed, isolate sandbox containers on per-tenant networks and disable inter-container communication on the shared bridge.\n- Rotate any vault secrets that sandbox containers could have read.","reach":"network","title":"LangAlpha: shared Docker bridge lets tenants reach each other's sandboxes","impact":"medium","summary":"LangAlpha places every tenant's sandbox container on Docker's shared default bridge network with inter-container communication enabled. An authenticated user who can run code in their own sandbox can connect to other tenants' containers and read their files, including vault secrets.","category":"ai-tooling","nicknames":[],"who_cares":["langalpha","self-hosted","docker","multi-tenant","ai-agents"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other tenants' files and vault secrets readable from a sandbox","analyst_note":"Find the LangAlpha fixed version and the default network config from the NVD entry or the project's repository; the sources give neither.","how_to_check":"- Check whether sandbox containers share the default `bridge` network, for example with `docker network inspect bridge` and looking for the sandbox containers.\n- Confirm whether inter-container communication is enabled on that bridge (`com.docker.network.bridge.enable_icc` set to true or unset).\n- unknown for any other LangAlpha-specific setting the sources do not name.","needs_analyst":true,"not_affected_if":["single-tenant","isolated-sandbox-networks"],"who_is_affected":"Teams that run LangAlpha with multiple tenants on one host, where user-submitted code runs in per-tenant sandbox containers on Docker's default bridge network. Single-tenant deployments, or ones where sandboxes already sit on isolated networks, are less exposed. The sources do not say which default configuration is vulnerable beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":3346,"output_tokens":728,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109441':14A,17A '-2026':13A,16A '2026.09.07':78C 'agent':20B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'authent':53B,103C 'bridg':4A,44B,95C 'bypass':119C 'check':123C 'code':58B,106C 'communic':50B,101C 'connect':64B,113C 'contain':38B,49B,68B,79C,89C,100C,118C 'cve':12A,15A 'default':43B,94C 'direct':114C 'docker':3A,24B,40B,91C 'enabl':51B,102C 'everi':34B 'execut':107C 'expos':132C 'file':72B,126C 'host':31B 'improp':81C 'includ':73B 'inter':48B,99C 'inter-contain':47B,98C 'isol':82C 'langalpha':1A,25B,32B,76C 'let':5A 'multi':27B 'multi-ten':26B 'network':45B,96C 'owner':122C 'place':33B,85C 'reach':7A 'read':70B,125C 'requir':120C 'run':57B 'sandbox':11A,37B,62B,88C,111C 'secret':75B,130C 'self':30B 'self-host':29B 'server':133C 'share':2A,42B,93C 'tenant':6A,28B,35B,67B,87C,117C 'tool':23B 'user':54B,104C 'vault':74B,129C 'vulner':83C 'workspac':121C","nicknames":[],"mitigations":[],"who_affected":"Teams that run LangAlpha with multiple tenants on one host, where user-submitted code runs in per-tenant sandbox containers on Docker's default bridge network. Single-tenant deployments, or ones where sandboxes already sit on isolated networks, are less exposed. The sources do not say which default configuration is vulnerable beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109441","severity":null,"published_at":"2026-10-20T01:17:10+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}