CVE-2026-61670 — MEDIUM (6.5)

Vulnerability Description

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-214

References

FAQ

What is CVE-2026-61670?

CVE-2026-61670 is a vulnerability with a CVSS score of 6.5 (MEDIUM). microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and pas...

How severe is CVE-2026-61670?

CVE-2026-61670 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-61670?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.