An access control vulnerability in docker-socket-proxy allows unauthorized access to container information, potentially exposing sensitive filesystem metadata.

This is an insufficient granularity of access control (CWE-1220) issue where read-only endpoints are not correctly gated. An attacker on the adjacent network can exploit this to gain unauthorized information about container state and configurations.

Successful exploitation allows an attacker to gather intelligence on the container environment, which can be leveraged to plan further attacks. While the CVSS score of 7.4 indicates high severity, the impact is limited to information disclosure regarding container filesystems and metadata rather than full system execution.

Immediate Action: Update docker-socket-proxy to a version beyond 0.5.0 that addresses the access control gating. Review the configuration of the CONTAINERS environment variable to ensure it is not inadvertently granting broad access.

Proactive Monitoring: Review container access logs for unexpected queries to the /containers API namespace. Monitor for unusual spikes in read requests to the Docker socket.

Compensating Controls: Ensure the docker-socket-proxy is only accessible over a restricted network segment or via a VPN, and verify that the host machine's firewall rules are strictly enforced.

Public Exploit Available: No (exploit_available: unknown)

Administrators should prioritize updating to the latest version of docker-socket-proxy to ensure proper access control logic is applied. Additionally, verify that environment variables are configured with the principle of least privilege to minimize the potential impact of any access control flaws.