{"id":"EUVD-2026-83445","revision":null,"records":[{"revision":"e2bcead2a4564346a2de12d38c9383fe","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61670","aliases":[],"title":"microsandbox: Secret values exposed in world-readable process arguments","description":"microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.","state":0,"publishedAt":"2026-09-18T20:41:31.276+00:00","modifiedAt":"2026-09-21T20:47:18.601+00:00","affected":[{"ecosystem":"Vendor product","name":"microsandbox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"superradcompany\",\n                    \"product\": \"microsandbox\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.5.10\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3","https://github.com/superradcompany/microsandbox/issues/997","https://github.com/superradcompany/microsandbox/pull/1006","https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8","https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4","https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61670","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61670","identifiers":["CVE-2026-61670"]},"retained":false,"historicalAffected":[]},{"revision":"97b3214e88f7466c94c62fbfafe98b0d","observedAt":"2026-11-11T15:02:53.848+00:00","statement":{"source":"euvd","id":"EUVD-2026-83445","aliases":["CVE-2026-61670","GHSA-m8f5-rh7h-vgg3"],"title":"microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated…","description":"microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":6.5,"severity":null}],"references":["https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3","https://github.com/superradcompany/microsandbox/issues/997","https://github.com/superradcompany/microsandbox/pull/1006","https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8","https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4","https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83445","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2026, 8:41:31 PM","dateUpdated":"Sep 21, 2026, 8:47:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83445","identifiers":["EUVD-2026-83445","CVE-2026-61670","GHSA-m8f5-rh7h-vgg3"]},"retained":false,"historicalAffected":[]},{"revision":"a4a5aa7b7a144965951b54f4cb5afa44","observedAt":"2026-10-25T14:19:22.811+00:00","statement":{"source":"nvd","id":"CVE-2026-61670","aliases":[],"title":"microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated…","description":"microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.","state":0,"publishedAt":"2026-09-18T21:17:01.973+00:00","modifiedAt":"2026-09-24T21:25:27.05+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8","https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4","https://github.com/superradcompany/microsandbox/issues/997","https://github.com/superradcompany/microsandbox/pull/1006","https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10","https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61670","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-214"],"productCriteria":[],"sourceDates":{"published":"2026-09-18T21:17:01.973","lastModified":"2026-09-24T21:25:27.050"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-61670","identifiers":["CVE-2026-61670"]},"retained":false,"historicalAffected":[]},{"revision":"18c609f3793540a388bd565ec98a25a9","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-m8f5-rh7h-vgg3","aliases":["CVE-2026-61670"],"title":"microsandbox: Secret values exposed in world-readable process arguments","description":"## Summary\n\nWhen the SDK spawns a sandbox, the `msb sandbox` child process receives the full network configuration as an inline `--network-config <json>` command-line argument, and any per-sandbox environment as repeated `--env KEY=VALUE` arguments. On Linux a process's arguments are world-readable via `/proc/<pid>/cmdline`, and on both Linux and macOS they are visible to other local processes via `ps`. Because the network configuration carries the real secret values used for host-side secret substitution, any unprivileged local user (or any process running as a different user on the same host) can read those secrets directly out of the process listing for as long as the sandbox is running. This defeats the \"secrets that can't leak\" guarantee for the host side of the boundary.\n\n## Details\n\nThe SDK serializes the entire `NetworkConfig`, including the real (non-placeholder) secret values, and pushes it onto the child argv, in `sdk/rust/lib/runtime/spawn.rs` near line 1241:\n\n```rust\nlet net_json = serde_json::to_string(&config.network)\n     .expect(\"failed to serialize network config\");\nargs.push(OsString::from(\"--network-config\"));\nargs.push(OsString::from(net_json));   // secrets land in argv here\n```\n\nThe CLI accepts it only as an inline string and parses it with `serde_json::from_str`, so there is no off-argv channel today. The field is declared at `crates/cli/lib/sandbox_cmd.rs` line 152 and parsed near line 234:\n\n```rust\n/// Network configuration as JSON.\npub network_config: Option<String>,\n\n// parsed near line 234\n.map(|json| serde_json::from_str::<NetworkConfig>(json).expect(...))\n```\n\nThe same exposure applies to environment values, which are passed one per argument (`spawn.rs` ~lines 1249-1251):\n\n```rust\nfor (key, value) in &config.env {\n    args.push(OsString::from(\"--env\"));\n    args.push(OsString::from(format!(\"{key}={value}\")));\n}\n```\n\nAny secret a user places in `env` or in the network config (e.g. upstream API keys used for the host-side proxy substitution) is therefore present in the process command line.\n\nThe fix and reusable in-repo patterns are tracked, from a readability angle, in issue #997: passing bulky config over an inherited file descriptor (`--network-config-fd <n>`) the way `--parent-watch-fd` already does (`spawn.rs` lines 207-233, `vm::PARENT_WATCH_FD`) removes the values from argv entirely. An env-var alternative does not fully fix this as `/proc/<pid>/environ` is still readable by the same uid and root and is inherited by children, so an fd or reference handoff is the appropriate channel for secret material.\n\n## PoC\n\n1. Launch any sandbox that includes a secret, e.g. a network config with an upstream credential to be substituted, or an `--env` carrying a token.\n2. From a separate, unprivileged shell on the same host (no root, different local user is sufficient):\n3. The output contains the full `--network-config {...}` JSON with the real secret values, and any `--env KEY=VALUE` secrets, in cleartext.\n\nNo special privileges, no debugger, and no access to the spawning user's session are required. The window of exposure is the entire lifetime of the sandbox process.\n\n## Impact\n\nLocal information disclosure of secrets (CWE-214: invocation of process using visible sensitive information / CWE-200). Any local user or co-resident process on the host running a microsandbox can read credentials that were meant to stay host-side and never reach untrusted code. This is most serious on shared or multi-tenant hosts, CI runners, and developer machines running other untrusted tooling, where the threat model explicitly assumes the secret never leaves the trusted host boundary. The vulnerability does not require code execution inside the sandbox; it is exploitable purely from the host's process table.","state":0,"publishedAt":"2026-09-22T19:43:04+00:00","modifiedAt":"2026-09-22T20:00:05.1782282+00:00","affected":[{"ecosystem":"crates.io","name":"microsandbox","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3","https://nvd.nist.gov/vuln/detail/CVE-2026-61670","https://github.com/superradcompany/microsandbox/issues/997","https://github.com/superradcompany/microsandbox/pull/1006","https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8","https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4","https://github.com/superradcompany/microsandbox","https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10"],"sourceUrl":"https://github.com/advisories/GHSA-m8f5-rh7h-vgg3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m8f5-rh7h-vgg3","identifiers":["GHSA-m8f5-rh7h-vgg3","CVE-2026-61670"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T11:55:28.1860721+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T11:55:28.1860721+00:00","lastSuccessAt":"2026-11-12T11:55:28.4130785+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.4130791+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-4a4604796d7c0adea2c1c677026f25a1e039e4a95710b02ad846575329daaa79","complete":true,"records":424651,"lastAttemptAt":"2026-11-12T11:53:33.8199862+00:00","lastSuccessAt":"2026-11-12T11:53:33.7811873+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:53:33.8199862+00:00","snapshotPublishedAt":"2026-11-12T11:27:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0580dcc98aaa46a8935f8ff576f25037","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T11:56:20.2141865+00:00","lastSuccessAt":"2026-11-12T11:56:20.209+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:56:20.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T11:55:28.1860721+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T11:55:28.1860721+00:00","lastSuccessAt":"2026-11-12T11:55:28.4142299+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.4142304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ea8d0b9744d8407d9df5932458afeb6a","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T11:55:53.6222651+00:00","lastSuccessAt":"2026-11-12T11:55:53.618+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:53.618+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T11:55:28.0344457+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.0344457+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T11:53:33.8856695+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:53:33.8856695+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T11:55:28.1484531+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.1484531+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e59fd13399d7070c31f5f25102a6bcd537ccba91d773c8427fcf0d07ea0fe2d5","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T11:55:27.8998515+00:00","lastSuccessAt":"2026-11-12T11:55:26.4268762+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:27.8998515+00:00","snapshotPublishedAt":"2026-11-12T11:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}