CVE-2026-78122: docker-socket-proxy Information Disclosure

CVE-2026-78122 Overview

CVE-2026-78122 is a broken access control flaw in Tecnativa's docker-socket-proxy, a HAProxy-based filtering layer used to expose a subset of the Docker Engine API to containers such as Traefik, Portainer, and Watchtower. When the CONTAINERS environment variable is set to allow read access to the /containers namespace, the proxy fails to gate several sensitive read endpoints. Attackers reachable on the same network as the proxy can issue GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files inside containers and download entire container filesystems as tar archives.

Critical Impact
An adjacent-network attacker with access to a docker-socket-proxy instance can exfiltrate secrets, credentials, and full container filesystems without authentication.

Affected Products

Tecnativa docker-socket-proxy (HAProxy-based configurations exposing the CONTAINERS scope)
Deployments referencing the vulnerable haproxy.cfg from release v0.5.0
Downstream stacks that mount docker-socket-proxy for Traefik, Portainer, Watchtower, or similar tooling

Discovery Timeline

2026-08-22 - CVE-2026-78122 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78122

Vulnerability Analysis

The root issue is insufficient access control granularity in the HAProxy ACL ruleset that fronts the Docker socket. The proxy treats the CONTAINERS environment variable as a coarse toggle enabling the entire /containers API namespace for GET requests. Under the Docker Engine API, that namespace includes several endpoints that expose container internals, not just metadata.

Specifically, GET /containers/{id}/archive returns any path inside a running container as a tar stream, and GET /containers/{id}/export streams the full filesystem of a container. GET /containers/{id}/logs returns stdout and stderr, which frequently contain tokens, database URIs, and application secrets. GET /containers/{id}/top reveals process arguments, which can leak credentials passed on the command line. This aligns with CWE-1220: Insufficient Granularity of Access Control.

Root Cause

The HAProxy configuration shipped in v0.5.0 (see Tecnativa HAProxy Configuration) permits every GET request whose path matches /containers when the operator sets CONTAINERS=1. It does not sub-filter high-impact read endpoints. Operators enabling container inspection for a management tool inadvertently expose filesystem export and archive retrieval to any peer that can reach the proxy.

Attack Vector

Exploitation requires network reachability to the proxy on its listening port, typically inside a Docker or Kubernetes network. No authentication or user interaction is required. An attacker enumerates container IDs via GET /containers/json, then issues a request such as GET /containers/{id}/archive?path=/ to retrieve any file inside a target container, or GET /containers/{id}/export to download the entire container filesystem as a tar archive. The public proof-of-concept demonstrates each endpoint in sequence. See the VulnCheck Advisory on Docker Socket Proxy and GitHub Gist PoC Resource for technical details.

Detection Methods for CVE-2026-78122

Indicators of Compromise

HAProxy or docker-socket-proxy access logs containing GET requests to /containers/*/archive, /containers/*/export, /containers/*/logs, or /containers/*/top from unexpected client IPs.
Large outbound response bodies from the proxy port, consistent with tar streams from /export or /archive.
Repeated /containers/json enumeration followed by targeted requests against specific container IDs.

Detection Strategies

Enable HAProxy request logging on the proxy and forward logs to a central SIEM for URI-pattern analysis.
Baseline which client containers legitimately call the proxy, then alert on any new source calling the vulnerable endpoints.
Inspect east-west traffic on Docker bridge and overlay networks for anomalous byte volumes flowing from the proxy.

Monitoring Recommendations

Correlate proxy access logs with container runtime events to spot enumeration followed by archive or export retrieval.
Monitor for docker-socket-proxy deployments where CONTAINERS=1 is set alongside broad network reachability.
Track process listings from /top calls that could disclose command-line credentials, and rotate any secrets observed.

How to Mitigate CVE-2026-78122

Immediate Actions Required

Restrict network exposure of docker-socket-proxy to only the specific management containers that require it, using dedicated Docker networks.
Set CONTAINERS=0 where operational tooling does not strictly require container inspection.
Rotate any credentials, tokens, or secrets that may have been logged to stdout or passed as command-line arguments in exposed containers.

Patch Information

A fix has been proposed upstream in Tecnativa Pull Request #183, tracked in Tecnativa Issue Tracker #182. Operators should upgrade to a release that incorporates the tightened HAProxy ACLs blocking /archive, /export, /logs, and /top under the CONTAINERS scope. Consult the Tecnativa Docker Socket Proxy repository for release notes before deploying.

Workarounds

Override haproxy.cfg with a custom configuration that denies GET requests to /containers/*/archive, /containers/*/export, /containers/*/logs, and /containers/*/top.
Place the proxy behind an authenticated reverse proxy or mTLS-terminated ingress limited to trusted clients.
Replace docker-socket-proxy with a purpose-built API broker that enforces per-endpoint policy for the specific management tool in use.

bash

# Example HAProxy ACL additions to block sensitive /containers read endpoints
acl block_archive path_reg ^/(v[\d\.]+/)?containers/[^/]+/archive$
acl block_export  path_reg ^/(v[\d\.]+/)?containers/[^/]+/export$
acl block_logs    path_reg ^/(v[\d\.]+/)?containers/[^/]+/logs$
acl block_top     path_reg ^/(v[\d\.]+/)?containers/[^/]+/top$
http-request deny if block_archive || block_export || block_logs || block_top