CVE-2026-61670

When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config <json> command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via /proc/<pid>/cmdline, and on both Linux and macOS they are visible to other local processes via ps. Because the network configuration carries the real secret values used for host-side secret substitution, any unprivileged local user (or any process running as a different user on the same host) can read those secrets directly out of the process listing for as long as the sandbox is running. This defeats the "secrets that can't leak" guarantee for the host side of the boundary.

Details

The SDK serializes the entire NetworkConfig, including the real (non-placeholder) secret values, and pushes it onto the child argv, in sdk/rust/lib/runtime/spawn.rs near line 1241:

let net_json = serde_json::to_string(&config.network)
     .expect("failed to serialize network config");
args.push(OsString::from("--network-config"));
args.push(OsString::from(net_json));   // secrets land in argv here

The CLI accepts it only as an inline string and parses it with serde_json::from_str, so there is no off-argv channel today. The field is declared at crates/cli/lib/sandbox_cmd.rs line 152 and parsed near line 234:

/// Network configuration as JSON.
pub network_config: Option<String>,

// parsed near line 234
.map(|json| serde_json::from_str::<NetworkConfig>(json).expect(...))

The same exposure applies to environment values, which are passed one per argument (spawn.rs ~lines 1249-1251):

for (key, value) in &config.env {
    args.push(OsString::from("--env"));
    args.push(OsString::from(format!("{key}={value}")));
}

Any secret a user places in env or in the network config (e.g. upstream API keys used for the host-side proxy substitution) is therefore present in the process command line.

The fix and reusable in-repo patterns are tracked, from a readability angle, in issue #997: passing bulky config over an inherited file descriptor (--network-config-fd <n>) the way --parent-watch-fd already does (spawn.rs lines 207-233, vm::PARENT_WATCH_FD) removes the values from argv entirely. An env-var alternative does not fully fix this as /proc/<pid>/environ is still readable by the same uid and root and is inherited by children, so an fd or reference handoff is the appropriate channel for secret material.

PoC

1. Launch any sandbox that includes a secret, e.g. a network config with an upstream credential to be substituted, or an --env carrying a token.
2. From a separate, unprivileged shell on the same host (no root, different local user is sufficient):
3. The output contains the full --network-config {...} JSON with the real secret values, and any --env KEY=VALUE secrets, in cleartext.

No special privileges, no debugger, and no access to the spawning user's session are required. The window of exposure is the entire lifetime of the sandbox process.