docker-socket-proxy Flaw Exposes Container Filesystems via `CONTAINERS=1`
Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 23, 2026
A security flaw in Tecnativa docker-socket-proxy allows unintended read access to container data when the proxy is configured with CONTAINERS=1, even if POST=0 is set. Public reports and a proof of concept show that the proxy's HAProxy rules broadly permit the Docker API /containers/* namespace, enabling an attacker with access behind the proxy to list containers and reach sensitive GET endpoints that were not meant to be exposed.
The exposed endpoints reportedly include /archive, /export, /logs, and /top, which can be used to read arbitrary files from containers, export full container filesystems, inspect process arguments, and retrieve logs. An open issue states there is no built-in mitigation short of manually editing the HAProxy configuration, while a linked pull request proposes restricting filesystem-related exposure through more granular controls such as ALLOW_ARCHIVE, ALLOW_EXPORT, and ALLOW_LOGS and corresponding HAProxy configuration changes.
