CVE-2026-61670: Microsandbox Information Disclosure Flaw

CVE-2026-61670 Overview

CVE-2026-61670 is an information disclosure vulnerability in microsandbox, a local-first microVM runtime and library. Versions prior to 0.5.10 serialize NetworkConfig secret values into the --network-config argument and pass per-sandbox secrets through repeated --env arguments in crates/cli/lib/sandbox_cmd.rs. These values become visible to any local user or co-resident process that can read the host process table, including /proc/<pid>/cmdline on Linux and ps output on Linux and macOS. The weakness is classified as [CWE-214] (Invocation of Process Using Visible Sensitive Information). It is fixed in version 0.5.10.

Critical Impact
Local users on shared hosts, CI runners, and developer systems can harvest API keys, tokens, and environment secrets simply by listing running processes — no code execution inside the sandbox or access to the spawning user's session is required.

Affected Products

microsandbox versions prior to 0.5.10
The Rust SDK spawn logic in sdk/rust/lib/runtime/spawn.rs
The CLI argument handling in crates/cli/lib/sandbox_cmd.rs

Discovery Timeline

2026-09-18 - CVE-2026-61670 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61670

Vulnerability Analysis

microsandbox launches each sandbox by spawning the msb sandbox process with configuration passed on the command line. The SDK serializes the entire NetworkConfig, including any secret fields, into a single --network-config argument. Per-sandbox environment variables are appended as repeated --env KEY=VALUE pairs. On Unix-like systems, process arguments are world-readable via the kernel process table. Any local user can enumerate secrets with a simple ps auxww or by reading /proc/<pid>/cmdline for the sandbox's lifetime.

Root Cause

The root cause is a design decision to pass bulky and sensitive configuration through argv instead of a private channel. Command-line arguments on Linux are exposed through /proc/<pid>/cmdline, which is readable by other UIDs by default. macOS exposes the same data through ps and related APIs. Because secrets sit in argv for the entire lifetime of the child process, the exposure window matches sandbox uptime.

Attack Vector

Exploitation is local and requires only unprivileged shell access on the same host. An attacker running under a different user account, a co-resident CI job, or a low-privilege service can poll the process table and extract API keys, cloud tokens, and environment secrets. No sandbox escape, privilege escalation, or session hijack is required. Shared build hosts and multi-tenant developer systems are the primary risk environments.

The upstream fix in commit 2ac6a17 introduces a typed launch contract that hands configuration to the sandbox process over an inherited file descriptor instead of argv:

rust

//! The typed launch contract between the SDK and the `msb sandbox` process.
//!
//! [`LaunchConfig`] is the bulk of a sandbox's configuration. The SDK builds
//! it, serializes it as JSON, and hands it to `msb sandbox` over an inherited
//! file descriptor (see [`crate::vm::CONFIG_FD`]); the process deserializes it
//! and builds its [`crate::vm::Config`] from it. Only a few operator-readable
//! labels and the real inherited fds stay on the process argv. This keeps the
//! network config and secret-bearing env out of `ps` and `/proc/<pid>/cmdline`
//! — see issue #997.

use std::path::PathBuf;
use serde::{Deserialize, Serialize};

#[cfg(feature = "net")]
use microsandbox_network::config::NetworkConfig;

use crate::vm::{MetricsSlotHandoff, StartupCommand};

/// The bulk `msb sandbox` configuration delivered over the config fd.
#[derive(Debug, Default, Clone, Serialize, Deserialize)]
pub struct LaunchConfig {
    /// Path to the sandbox database file.
    pub db_path: PathBuf,
}

Source: GitHub Commit 2ac6a17

Detection Methods for CVE-2026-61670

Indicators of Compromise

Presence of msb sandbox processes with --network-config or --env arguments containing secret material in /proc/<pid>/cmdline.
Unexpected reads of /proc/*/cmdline or repeated invocations of ps by non-administrative users.
Access to secrets from users, service accounts, or CI jobs that never received them through legitimate channels.

Detection Strategies

Inventory installed microsandbox versions across developer laptops, build agents, and shared hosts, flagging any release below 0.5.10.
Deploy audit rules that log process command-line inspection by unexpected UIDs on multi-tenant Linux systems.
Correlate secret usage in downstream systems against the users authorized to hold those secrets, treating mismatches as suspicious.

Monitoring Recommendations

Enable Linux auditd rules on /proc/*/cmdline reads on shared hosts and CI runners.
Monitor for long-lived msb sandbox processes and capture their argv snapshot for offline review.
Rotate any API keys or tokens that were passed to microsandbox sandboxes before upgrading, and monitor those credentials for anomalous use.

How to Mitigate CVE-2026-61670

Immediate Actions Required

Upgrade microsandbox to version 0.5.10 or later on all hosts, developer systems, and CI runners.
Rotate every API key, token, and environment secret that was previously delivered to a sandbox via --env or --network-config.
Audit shared hosts for other users or workloads that may have observed the exposed arguments.

Patch Information

The fix is delivered in GitHub Release v0.5.10 via Pull Request #1006 and commits 2ac6a17 and fbfb236. The patch introduces a LaunchConfig structure serialized as JSON and passed over an inherited file descriptor (CONFIG_FD), keeping NetworkConfig and secret-bearing environment variables out of ps and /proc/<pid>/cmdline. See GitHub Security Advisory GHSA-m8f5-rh7h-vgg3 and GitHub Issue #997 for full context.

Workarounds

Restrict microsandbox usage to single-tenant hosts where no other unprivileged users or workloads are present until the upgrade is applied.
Mount /proc with the hidepid=2 option on Linux to prevent unprivileged users from viewing other users' process arguments.
Avoid passing high-value secrets to sandboxes on unpatched versions; substitute short-lived, scoped credentials that can be rotated quickly.

bash

# Harden /proc so unprivileged users cannot read other users' cmdline
sudo mount -o remount,hidepid=2,gid=proc /proc

# Verify no vulnerable microsandbox binaries remain
msb --version   # must report 0.5.10 or later