CVE-2026-78122: Insufficient Granularity of Access Control in Tecnativa docker-socket-proxy

Tecnativa docker-socket-proxy versions 0 through 0.5.0 improperly restrict access to read endpoints under the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can exploit this by sending GET requests to endpoints such as /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, enabling them to read arbitrary files and extract full container filesystems as tar archives. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity, with attack vector being adjacent network and no required privileges or user interaction.

Exploitation of this vulnerability allows attackers to access sensitive container data by reading arbitrary files and downloading entire container filesystems. This can lead to unauthorized disclosure of sensitive information contained within containers. The vulnerability does not require authentication or user interaction, increasing its risk in affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the docker-socket-proxy service and avoid setting the CONTAINERS environment variable if possible. Monitor vendor communications for updates and apply patches promptly once released.