{"id":"CVE-2026-126330","kind":"vulnerability","aliases":["CVE-2026-126330"],"related":[],"title":"Docker Sandboxes: removed port mapping can silently republish a sandbox service","description":"Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0.","summary":"Docker Sandboxes keeps the original publish request after an operator removes a host-port mapping, so a later port change or sandbox restart republishes the service on a new host port. An attacker who can reach that restored endpoint may regain access to the service it exposes.","severity":"low","cvss":2.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","docker-sandboxes","runtime","self-hosted"],"not_affected_if":["default-config","no-port-publishing"],"how_to_check":"- Run `docker sandbox version` (or check the Docker Sandboxes version in Docker Desktop) and compare against `0.53.0`\n- Review sandbox port publications and confirm no service is re-published after its mapping was removed\n- Confirm the publish bind address is loopback (default), not a wider interface","fix":null,"status":"open","published_at":"2026-11-12T16:19:04+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:48+00:00","updated_at":"2026-11-12T16:45:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T16:45:48Z","model":"claude-haiku-5-5","output":{"fix":"- Docker Sandboxes: move to `0.53.0`","reach":"network","title":"Docker Sandboxes: removed port mapping can silently republish a sandbox service","impact":"low","summary":"Docker Sandboxes keeps the original publish request after an operator removes a host-port mapping, so a later port change or sandbox restart republishes the service on a new host port. An attacker who can reach that restored endpoint may regain access to the service it exposes.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["docker","docker-sandboxes","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"a removed service is republished and reachable on a new port","analyst_note":"","how_to_check":"- Run `docker sandbox version` (or check the Docker Sandboxes version in Docker Desktop) and compare against `0.53.0`\n- Review sandbox port publications and confirm no service is re-published after its mapping was removed\n- Confirm the publish bind address is loopback (default), not a wider interface","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-port-publishing"],"who_is_affected":"Teams running Docker Sandboxes that publish sandbox services to a host port. Exposure is limited to the original bind address, which defaults to loopback, so setups that only bind to loopback face much less risk. Teams that never publish sandbox ports can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000731,"input_tokens":4612,"output_tokens":539,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126330':14A,17A '-2026':13A,16A '0.53.0':162C 'abl':125C 'access':68B,133C 'activ':97C 'address':151C 'affect':143C 'allow':105C 'assign':88C 'attack':59B,124C 'automat':87C 'bind':98C,150C 'chang':46B,109C 'cve':12A,15A 'daemon':94C 'default':153C 'docker':1A,18B,20B,26B,74C 'docker-sandbox':19B 'endpoint':65B,130C 'expos':73B 'exposur':144C 'fix':159C 'host':25B,39B,56B,90C,121C 'host-port':38B,89C 'issu':157C 'keep':28B 'later':44B,107C 'limit':146C 'loopback':155C 'map':5A,41B,92C,141C 'may':66B,131C 'new':55B,120C 'oper':35B,84C 'origin':30B,102C,149C 'port':4A,40B,45B,57B,91C,108C,122C 'public':103C 'publish':31B,114C 'reach':62B,127C 'regain':67B,132C 'remov':3A,36B,85C,95C 'republish':8A,50B,78C 'request':32B,104C 'restart':49B,112C 'restor':64B,129C 'retain':100C 'runtim':22B 'sandbox':2A,10A,21B,27B,48B,75C,80C,111C 'self':24B 'self-host':23B 'servic':11A,52B,71B,81C,116C,136C 'silent':7A,77C 'tcp':138C 'udp':140C 'version':161C","nicknames":[],"mitigations":[],"who_affected":"Teams running Docker Sandboxes that publish sandbox services to a host port. Exposure is limited to the original bind address, which defaults to loopback, so setups that only bind to loopback face much less risk. Teams that never publish sandbox ports can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","dockersandboxes","low","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126330':14A,17A '-2026':13A,16A 'cve':12A,15A 'docker':1A 'map':5A 'port':4A 'remov':3A 'republish':8A 'sandbox':2A,10A 'servic':11A 'silent':7A","search_b":"'access':68B 'attack':59B 'chang':46B 'docker':18B,20B,26B 'docker-sandbox':19B 'endpoint':65B 'expos':73B 'host':25B,39B,56B 'host-port':38B 'keep':28B 'later':44B 'map':41B 'may':66B 'new':55B 'oper':35B 'origin':30B 'port':40B,45B,57B 'publish':31B 'reach':62B 'regain':67B 'remov':36B 'republish':50B 'request':32B 'restart':49B 'restor':64B 'runtim':22B 'sandbox':21B,27B,48B 'self':24B 'self-host':23B 'servic':52B,71B","search_c":"'0.53.0':162C 'abl':125C 'access':133C 'activ':97C 'address':151C 'affect':143C 'allow':105C 'assign':88C 'attack':124C 'automat':87C 'bind':98C,150C 'chang':109C 'daemon':94C 'default':153C 'docker':74C 'endpoint':130C 'exposur':144C 'fix':159C 'host':90C,121C 'host-port':89C 'issu':157C 'later':107C 'limit':146C 'loopback':155C 'map':92C,141C 'may':131C 'new':120C 'oper':84C 'origin':102C,149C 'port':91C,108C,122C 'public':103C 'publish':114C 'reach':127C 'regain':132C 'remov':85C,95C 'republish':78C 'request':104C 'restart':112C 'restor':129C 'retain':100C 'sandbox':75C,80C,111C 'servic':81C,116C,136C 'silent':77C 'tcp':138C 'udp':140C 'version':161C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126330","severity":null,"published_at":"2026-11-12T16:19:04+00:00","modified_at":"2026-11-12T16:19:04+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}