The security boundary is between a model-driven shell and the runner that holds its credentials. In the pinned v2.4.6 implementation, Bubblewrap receives a list of filesystem bindings and a replacement PATH, but neither the --clearenv option nor an explicit sanitized child environment. Consequently, the shell inside the sandbox inherits the runner's…
Case · DiggingBeagle record
mini-swe-agent Bubblewrap inherited runner environment variables (CVE-2026-108592)
In mini-swe-agent 1.10.0 through 2.4.6, an experimental Bubblewrap backend did not clear inherited environment variables or isolate networking. A researcher demonstrated secret-like marker visibility inside the sandbox; actual credential theft was not demonstrated.
Scope
Optional, explicitly selected mini-swe-agent BubblewrapEnvironment on affected releases 1.10.0 through 2.4.6 according to the VulnCheck CNA. The directly inspected repository file is v2.4.6. Requires secrets in the parent environment and an agent command that reads them; not a blanket claim that every mini-swe-agent installation is sandboxed or affected.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The v2.4.6 source directly exhibits inherited parent environment and no default separate network namespace; the primary researcher reports a positive synthetic-marker test and a --clearenv negative control. That constitutes a demonstration of environment isolation failure, not of a successful malicious task, production compromise, exfiltration or affected frequency. The CNA affected-version interval is advisory evidence. Clearing/allowlisting child environment and independent egress restrictions are available mitigations; a fixed release has not been verified.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MINISWE-ENV-BOUNDARY · CLM-MINISWE-NETWORK · CLM-MINISWE-EXPERIMENT-LIMIT · CLM-MINISWE-AFFECTED · mini-swe-agent v2.4.6: BubblewrapEnvironment implementation · HaiND: mini-swe-agent Bubblewrap host-environment inheritance · CVE-2026-108592: mini-swe-agent Bubblewrap environment exposure
At a glance
Filesystem isolation is not equivalent to credential isolation. The concrete measured failure is environment inheritance; the path to theft remains conditional and should not be scored as an observed compromise.
Read the implicationsNo verified fixed mini-swe-agent version was established in reviewed primary materials. No documented real-world API-key theft or exploited deployment was found in the reviewed record. How frequently operators enable this experimental backend while loading secrets into the runner environment is unknown.
Limits and uncertaintyFull account
The security boundary is between a model-driven shell and the runner that holds its credentials. In the pinned v2.4.6 implementation, Bubblewrap receives a list of filesystem bindings and a replacement PATH, but neither the --clearenv option nor an explicit sanitized child environment. Consequently, the shell inside the sandbox inherits the runner's remaining variables. The same wrapper lacks --unshare-net, so filesystem restrictions do not by themselves restrict egress.
Nguyen Dinh Hai's original report reproduces inheritance using a synthetic marker on Bubblewrap 0.6.1 and confirms that adding --clearenv removes that marker. This is a concrete demonstration of a failed boundary, not a demonstration of a successful prompt injection or stolen API keys. To weaponize it, an adversary would still have to influence a task or repository passage, induce a command that reads available credentials, and pass the run mode's approval gate if present.
The October 10 CNA record assigns CVE-2026-108592 and a 6.0 CVSS v4.0 base score. No reviewed artifact establishes a patched release or field exploitation. Explicit environment allowlisting and separate network policy address different links: clearing variables prevents secret availability, while egress controls limit what a compromised workload can contact.
Mechanism and trust boundary
- 01
Attacker-influenced task
Untrusted task or repository text attempts to steer the agent toward a shell command reading environment variables.
Boundary: external task data to model-selected action
- 02
Inherited runner credentials
The chosen Bubblewrap backend starts bwrap with the runner environment and does not clear variables before launching bash.
Boundary: privileged runner process to restricted shell
- 03
Conditional disclosure
A successful command could expose the variable in stdout or via a network connection if the run mode and surrounding host permit it; actual theft was not shown.
Boundary: sandbox output and networking to downstream services
Timeline
- Oct 10, 2026disclosure
Public disclosure
Claims & evidence
CLM-MINISWE-NETWORKThe default Bubblewrap wrapper arguments also omit --unshare-net, so the studied sandbox does not establish a separate network namespace; this increases the consequence of a model-directed command reading an inherited secret.supported
Basis: reported finding
- supportsmini-swe-agent v2.4.6: BubblewrapEnvironment implementationpatch commit artifact
BubblewrapEnvironmentConfig.wrapper_args, pinned v2.4.6 lines 37-67
- supportsHaiND: mini-swe-agent Bubblewrap host-environment inheritanceprimary disclosure
Root cause sections 1 and 2; Impact and limits
CLM-MINISWE-AFFECTEDVulnCheck lists mini-swe-agent versions 1.10.0 through 2.4.6 as affected by CVE-2026-108592, published October 10, 2026, with CWE-526 and CVSS v4.0 score 6.0.supported
Basis: reported finding
- supportsCVE-2026-108592: mini-swe-agent Bubblewrap environment exposureprimary disclosure
CVE_RECORD.cveMetadata.datePublished; containers.cna.affected[0].versions; problemTypes; metrics.cvssV4_0.baseScore
CLM-MINISWE-ENV-BOUNDARYIn the inspected v2.4.6 BubblewrapEnvironment code, default wrapper arguments omit --clearenv and subprocess.run supplies no env mapping; the reporter reproduced inheritance of a nonsecret host marker into the sandboxed shell and its removal when --clearenv was added.supported
Basis: reported finding
- supportsmini-swe-agent v2.4.6: BubblewrapEnvironment implementationpatch commit artifact
BubblewrapEnvironmentConfig.wrapper_args (file lines 37-67) and BubblewrapEnvironment.execute, subprocess.run call (lines 79-104)
- supportsHaiND: mini-swe-agent Bubblewrap host-environment inheritanceprimary disclosure
Verification, synthetic MSWEA_AUDIT_SENTINEL experiment and negative control
CLM-MINISWE-EXPERIMENT-LIMITThe researcher tested environment inheritance with a synthetic marker, not a complete injected agent run, an actual provider key, or real network exfiltration; BubblewrapEnvironment is described by the project as experimental and optional.supported
Basis: reported finding
- supportsHaiND: mini-swe-agent Bubblewrap host-environment inheritanceprimary disclosure
Verification and Impact and limits; explicit statement that no full agent loop or credential theft was tested
- supportsmini-swe-agent v2.4.6: BubblewrapEnvironment implementationpatch commit artifact
Module header warning: This environment is experimental
Implications
Filesystem isolation is not equivalent to credential isolation. The concrete measured failure is environment inheritance; the path to theft remains conditional and should not be scored as an observed compromise.
Controls and mitigations
- Before launching a sandbox, clear inherited environment variables and explicitly restore only necessary allowlisted values; cover this with a negative-control regression test.
- Separate outgoing network permissions from filesystem restrictions, and deny egress unless the agent task requires it.
- Do not place long-lived provider credentials into the environment visible to untrusted model-generated processes; require meaningful confirmation for secret-reading commands.
Unknowns and contradictions
- No verified fixed mini-swe-agent version was established in reviewed primary materials.
- No documented real-world API-key theft or exploited deployment was found in the reviewed record.
- How frequently operators enable this experimental backend while loading secrets into the runner environment is unknown.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 126