CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints

Overview

A high-severity authorization bypass vulnerability (CVSS 7.4) has been disclosed in docker-socket-proxy, a popular security middleware used to restrict access to the Docker daemon socket. Despite the CONTAINERS environment variable being configured to restrict container access, the proxy fails to block read-only GET requests to several sensitive container API endpoints.

Attackers who gain access to the proxy can use GET requests to read arbitrary files from container filesystems, stream logs, list running processes, and export entire container snapshots — without the CONTAINERS guard having any effect.

Technical Details

Bypassed Endpoints

The CONTAINERS environment variable in docker-socket-proxy is intended to gate the entire /containers Docker API namespace. However, the following endpoints are not properly restricted and remain accessible via GET requests:

Attack Scenario

A common deployment pattern is to expose docker-socket-proxy to services like Traefik, Portainer agents, or monitoring tools, granting them scoped access to the Docker API rather than full socket access. With this vulnerability, any service with proxy access can:

1. Enumerate container IDs through permitted endpoints
2. Call /containers/{id}/archive?path=/etc/passwd to read sensitive files
3. Call /containers/{id}/logs to harvest application secrets written to stdout
4. Call /containers/{id}/export to obtain a complete filesystem snapshot

This is particularly dangerous in multi-tenant or shared hosting environments where docker-socket-proxy is used as a security boundary.

Affected Systems

All versions of docker-socket-proxy that have the CONTAINERS environment variable enabled are affected. This includes the widely used Tecnativa/docker-socket-proxy image.

Operators using docker-socket-proxy as a security control for services such as:

• Traefik (dynamic container routing)
• Portainer agents
• CI/CD pipelines with Docker access
• Monitoring agents (cAdvisor, Prometheus exporters)

…should treat their deployments as potentially compromised until patched.

Impact Assessment

Exploitation allows an attacker with proxy access to:

1. Read arbitrary files from any accessible container's filesystem, potentially including credentials, SSH keys, application secrets, and configuration files
2. Extract full container filesystems for offline analysis
3. Monitor application logs in real time, potentially harvesting authentication tokens or other sensitive data written to stdout
4. Map running processes inside containers to identify further attack surface

Recommended Mitigations

1. Apply vendor patch — monitor the docker-socket-proxy GitHub repository for a patched release and update immediately
2. Restrict proxy network access — ensure only explicitly trusted services can reach the docker-socket-proxy listener; do not expose it beyond the internal Docker network
3. Audit proxy consumers — review which services access the proxy and whether any unexpected access has occurred
4. Add explicit deny rules — if possible, layer additional network policy or application-level controls to block the affected endpoint paths
5. Monitor Docker API access logs — alert on unexpected calls to /archive, /export, /logs, or /top endpoints through the proxy

References

• NVD Entry: CVE-2026-78122
• CWE-862: Missing Authorization