CVE-2026-61670— microsandbox 进程参数泄露敏感信息漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

superradcompany microsandbox

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments acc

CVE-2026-61670 影响 superradcompany microsandbox。尚无明确在野利用证据，仍需结合暴露面评估。microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-con CVE-2026-61670 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-61670

一、 漏洞 CVE-2026-61670 基础信息

受影响产品

二、漏洞 CVE-2026-61670 的公开POC

三、漏洞 CVE-2026-61670 的情报信息

CVE-2026-61670 补丁与修复 (1)

• 🔗 feat(sandbox): move bulky config onto an inherited config fd by appcypher · Pull Request #1006 · superradcompany/microsandbox 查看完整文章 x_refsource_MISC

CVE-2026-61670 其他参考 (3)

• 🔗 Slim down the msb sandbox process command line (it's very long and hard to read) · Issue #997 · superradcompany/microsandbox 查看完整文章 x_refsource_MISC
• 🔗 Release v0.5.10 · superradcompany/microsandbox · GitHub x_refsource_MISC
• 🔗 Secret values exposed in world-readable process arguments · Advisory · superradcompany/microsandbox · GitHub 查看完整文章 x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2026-61670

IV. Related Vulnerabilities

V. Comments for CVE-2026-61670