The docker-socket-proxy component from Tecnativa fails to properly restrict access to read endpoints within the /containers Docker API namespace when the CONTAINERS environment variable is configured. This insufficient granularity in access control permits unauthenticated attackers to perform GET requests on endpoints like /containers/{id}/archive, /export, /logs, and /top. Exploiting these endpoints allows attackers to read arbitrary files and download full container filesystems as tar archives, potentially exposing sensitive data contained within Docker containers. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity, with attack vector being adjacent network and no privileges or user interaction required. As of the published date, no patch or vendor advisory specifying remediation is available.

Attackers can remotely access sensitive container data without authentication by exploiting improperly gated read endpoints in the docker-socket-proxy. This can lead to unauthorized disclosure of arbitrary files and entire container filesystems, potentially exposing confidential information or secrets stored within containers. The vulnerability does not require privileges or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the docker-socket-proxy service to trusted networks only and avoid setting the CONTAINERS environment variable if possible to reduce exposure.