CVE-2026-61670 Details
Description
microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.
A vulnerability in Microsandbox prior to version 0.5.10 allows for the exposure of secret values through command-line arguments. The issue arises because the application serializes sensitive information, such as network configuration secrets and environment variables, into the process's command-line arguments. This data can be accessed by other local users or processes on the same host via the process table, including through the '/proc' filesystem on Linux or process listings on macOS. The vulnerability does not require code execution within the sandbox or access to the user's session, and it can lead to the unintentional disclosure of API keys, tokens, and other sensitive information on shared hosts, CI runners, and developer systems.
Users can update to Microsandbox version 0.5.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/superradcompany/microsandbox/commit/2ac6a177b11212d392bf1e7dc77aaf14e4768aa8 | [email protected] | Source CodeVendor |
| https://github.com/superradcompany/microsandbox/commit/fbfb2366bfafad5e6df8778183f95fd8ca3c00a4 | [email protected] | Source CodeVendor |
| https://github.com/superradcompany/microsandbox/issues/997 | [email protected] | Issue TrackingVendor |
| https://github.com/superradcompany/microsandbox/pull/1006 | [email protected] | Issue TrackingVendor |
| https://github.com/superradcompany/microsandbox/releases/tag/v0.5.10 | [email protected] | Release NotesVendor |
| https://github.com/superradcompany/microsandbox/security/advisories/GHSA-m8f5-rh7h-vgg3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-214 | Invocation of Process Using Visible Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| superradcompany microsandbox | < 0.5.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |