{"id":"CVE-2026-101998","published":"2026-10-08T19:16:56.400","lastModified":"2026-10-08T20:46:35.260","description":"Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-636"],"vendors":[],"products":[],"references":[{"url":"https://docs.docker.com/ai/sandboxes/","tags":[]},{"url":"https://docs.docker.com/ai/sandboxes/configuration/credentials/#how-credential-injection-works","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}