CVE-2026-61670Medium· 6.5▾ Sunlitmicrosandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repea…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.2%
microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandbox_cmd.rs. Other local users or co-resident processes can read these values through the host process table, including /proc process command lines on Linux and process listings on Linux and macOS, for the lifetime of the sandbox. Exploitation does not require code execution inside the sandbox or access to the spawning user's session, and can disclose host-side API keys, tokens, and environment secrets on shared hosts, CI runners, and developer systems. This issue is fixed in version 0.5.10.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
microsandbox < 0.5.10Patched in:
microsandbox 0.5.10Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74873Medium· 5.5openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users
CVE-2026-92171Medium· 6.5Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
CVE-2026-113495Medium· 5.0Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
CVE-2026-113496Medium· 5.0Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-80158Medium· 5.5Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
CVE-2026-109971Medium· 4.7A flaw was found in the clevis PKCS#11 pin