CVE-2026-97693

Yuxi sandboxes can reach other tenants and internal services

Yuxi · Yuxi Docker Compose sandbox provisioner

First documented disclosure · Review checkpoint

Summary

A user with command execution in one sandbox can cross tenant boundaries in affected deployments.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer describes a cross-tenant attack path in affected deployments. No production compromise is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Execution sandboxes shared connectivity with other sandboxes, internal services and an unauthenticated management API. Shipped default credentials widened access where operators retained them.

Conditions required

A Docker deployment uses execution-capable sandboxes, and a low-privileged authenticated user can run commands in one. Which services are reachable depends on the deployment.

Potential impact

Other tenants’ files, outputs, secrets and active sandboxes can be exposed or modified. Provisioner access can disrupt sandboxes. Database-container execution requires additional database privileges.

Affected versions and configurations

0.6.0.beta1 through versions before 0.7.1.

Fix and mitigation status

0.7.1 introduces per-sandbox networks and provisioner authentication and removes production fallback credentials. Existing data volumes retain their old credentials until rotated.

Practical next steps

Upgrade, rebuild affected sandboxes with isolated networks, configure the provisioner token and rotate previously default or potentially exposed credentials. Disable sandbox execution until isolation is verified.

Operating lesson

Test from a low-privileged sandbox whether it can reach another tenant, a database or the provisioning API.

Evidence and limits

The July 17 fix and release predate the August 24 advisory and November 4 CNA. A container escape is unnecessary. Installations without active sandboxes and with independent service isolation fall outside the demonstrated path.

Sources