OpenSandbox

vdocker/egress/v1.1.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 15d Containers & Orchestration

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai ai-agent ai-infra kubernetes sandbox

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 12d

Credential Vault now mandates `dns+nft` enforcement for egress connections and trusts 'X‑Forwarded‑Proto' only from configured proxy CIDRs. The `Match.Ports` field has been removed; ports are derived automatically.

Why it matters: These breaking changes require updating egress configuration and trust settings before upgrading to avoid connectivity failures or security misconfigurations in deployments using Credential Vault.

Summary

AI summary

Updates 📦 Misc, ⚠️ Breaking Changes, and 🔧 Improvements across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Path traversal attempts rejected before credential injection, returning 403. Path traversal attempts rejected before credential injection, returning 403. Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking
Breaking	High	Credential Vault requires `dns+nft` enforcement for egress connections. Credential Vault requires `dns+nft` enforcement for egress connections. Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	'X-Forwarded-Proto' is trusted only from configured proxy CIDRs. 'X-Forwarded-Proto' is trusted only from configured proxy CIDRs. Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	`Match.Ports` field removed from Credential Vault bindings; ports derived from scheme. `Match.Ports` field removed from Credential Vault bindings; ports derived from scheme. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Credential Vault adds placeholder substitution for path, query, header, and body surfaces. Credential Vault adds placeholder substitution for path, query, header, and body surfaces. Source: llm_adapter@2026-07-15 Confidence: high	—
Dependency	Low	Egress images now also published to `ghcr.io` registry. Egress images now also published to `ghcr.io` registry. Source: llm_adapter@2026-07-15 Confidence: high	—
Performance	Low	OTel metrics normalized: attribute keys `.` → `_` and switched to delta temporality. OTel metrics normalized: attribute keys `.` → `_` and switched to delta temporality. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fallback to native `nft` when `iptables-nft` fails on NAT table append, preventing crash loops. Fallback to native `nft` when `iptables-nft` fails on NAT table append, preventing crash loops. Source: llm_adapter@2026-07-15 Confidence: high	—
Refactor	Low	Introduced `CredentialSource` provider interface and `SourceRegistry` for future secret manager integrations. Introduced `CredentialSource` provider interface and `SourceRegistry` for future secret manager integrations. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

What's New

⚠️ Breaking Changes

Credential Vault requires dns+nft enforcement. Credential-bound destinations can no longer be reached via direct-IP connections that bypass DNS. Deployments using DNS-only enforcement must migrate to mode = "dns+nft" in the [egress] config. defaultAction: allow still works but is deprecated for Credential Vault (emits a security warning); defaultAction: deny with explicit allow rules is recommended. (#1136)
X-Forwarded-Proto no longer trusted from arbitrary peers. Only trusted from IPs/CIDRs listed in OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS. Client-supplied forwarded headers are stripped and rebuilt from the observed connection. Deployments that terminate TLS in front of the egress sidecar must configure the trusted proxy CIDRs, otherwise Credential Vault will reject requests as non-HTTPS. (#1138)
Match.Ports removed from Credential Vault bindings. Port is now derived from scheme (http→80, https→443) — the only ports the intercept layer redirects. Remove the ports field from existing binding configs; SDK models regenerated. (#1189)

🔒 Security

Path traversal rejected before credential injection. When a vault is active, requests with raw ../, percent-encoded dot-segments (%2e%2e, mixed-case), or encoded path separators (%2f) now return 403 before binding match, preventing credential-scope escape via ambiguous paths. Legitimate clients resolve dot-segments before sending, so this is a strong evasion signal. When no vault is active, requests pass through unchanged. (#1192)

✨ Features

Credential Vault placeholder substitutions. Opt-in placeholder substitution for path, query, header, and body surfaces (including passthrough auth bindings), with request-side encoding rules and placeholder/value redaction. API contract, SDK models, docs, and e2e coverage updated. (#1251)

🐛 Bug Fixes

Fallback to native nft for DNS redirect. In some K8s pod netns, iptables-nft can list the nat table but fails on nat OUTPUT append (RULE_APPEND failed), causing the egress sidecar to crashloop. Now falls back to native nft DNS redirect rules, retries setup without dropping the table when it doesn't exist yet, and uses a plain drop for the default-deny fallback. (#1146)

🔧 Improvements

OTel metrics normalized. Attribute keys . → _ (http_method, http_status_code, routing_result) and OTLP export switched to delta temporality. Update dashboards/alerts accordingly. (#1209)
CredentialSource provider interface. Credential source resolution now goes through a CredentialSource interface + SourceRegistry, enabling future secret manager integrations (HashiCorp Vault, AWS SM, etc.) without touching wire format or SDK models. (#1186)

📦 Misc

GHCR image publishing. egress images now also published to ghcr.io. (#1161)

👥 Contributors

Thanks to these contributors ❤️

@bcho
@cwj2001
@hellomypastor
@jwx0925
@Pangjiping

Docker Hub: opensandbox/egress:v1.1.4
Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.4
GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.4

Breaking Changes

Credential Vault requires `mode = "dns+nft"` in `[egress]` config; DNS‑only enforcement is no longer supported.
`X-Forwarded-Proto` header trusted only from IPs/CIDRs listed in `OPENSANDBOX_EGRESS_CREDENTIAL_VAULT_TRUSTED_PROXY_CIDRS`; otherwise it is stripped and rebuilt.
Removed `Match.Ports` field from Credential Vault bindings; port now derived automatically from scheme.

Security Fixes

Path traversal (raw `../`, percent‑encoded dot‑segments, encoded separators) now rejected with 403 before credential injection when a vault is active.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OpenSandbox

Get notified when new releases ship.

About OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

All releases →

Related context

Related tools

Earlier breaking changes

vpython/sandbox/v0.1.14 Removes `CredentialMatch.ports`; port now derived from scheme.
vjava/sandbox/v1.0.16 Removes CredentialMatch.ports; port derived from scheme instead.
vserver/v0.2.0 Execd install path flattened from "/opt/opensandbox/bin/" to "/opt/opensandbox/".
vdocker/egress/v1.1.0 Removed environment variables OPENSANDBOX_EGRESS_MITMPROXY_CONFDIR and OPENSANDBOX_EGRESS_MITMPROXY_IGNORE_HOSTS.
vdocker/egress/v1.1.0 Mitmproxy static options moved from hardcoded flags to config.yaml.