A microVM boundary is not entirely implemented inside its virtual machine monitor. The Vercel Sandbox challenge identified a Linux host networking path that processed guest-controlled packets and, in the researcher's production tests, returned bytes from host memory. That is a demonstrated confidentiality crossing at the host boundary even when the guest…
Inspect the ClaimsCase · DiggingBeagle record
Vercel Sandbox guest packets disclosed host memory through Linux networking
Researcher-generated guest packets disclosed host memory on production Vercel sandboxes; host execution was demonstrated only on isolated replicas.
Scope
A particular Vercel Sandbox host Linux networking path exposed during the October 2026 challenge. Production information disclosure reproduced; host crash and privileged execution demonstrated on matching researcher-controlled configurations, not verified production takeover.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- demonstrated
- Impact
- Band 3 of 4
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Vercel confirms production reproduction of the network disclosure and coordination of patches with Linux maintainers and AWS. Candidate kernel fixes were still under private review at disclosure; host isolation measures were introduced. The public account does not establish stolen customer secrets or live malicious exploitation.
Impact basis: A kernel networking flaw leaked host-memory bytes from a real production sandbox to guest-visible packets. Host crash and administrator execution were reproduced only on researcher-controlled KVM or Firecracker analogues, so the score is not a verified production host takeover or mass data theft.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-VERCEL-SANDBOX-NET-LEAK · Vercel: findings from the one-million-dollar Sandbox challenge
At a glance
This distinction matters because a production memory leak has a different evidentiary scope than a laboratory-only host takeover, even when the cause is related.
Read the implicationsVercel reported no confirmed customer data access through the challenge. Kernel patches were undergoing coordinated review at disclosure and no public CVE was yet supplied. Do not infer all Firecracker installations share the same vulnerable kernel configuration.
Limits and uncertaintyFull account
A microVM boundary is not entirely implemented inside its virtual machine monitor. The Vercel Sandbox challenge identified a Linux host networking path that processed guest-controlled packets and, in the researcher's production tests, returned bytes from host memory. That is a demonstrated confidentiality crossing at the host boundary even when the guest cannot directly map host address space.
The same research explored stronger consequences, but the evidence is tiered. The report says crashes and privileged host execution were reproduced using the researcher's own KVM and Firecracker environments. It does not say those stronger effects succeeded on Vercel production hosts. The service also disclosed a broader bounty program with multiple validated findings; those totals are not a count of customers whose data was exposed through this one bug.
Kernel and platform mitigations were subject to coordinated handling at the time of disclosure. The remaining investigation is the upstream host-kernel mechanism, affected configuration scope and whether deployed fixes prevent packet-driven reads without breaking legitimate guest networking. Lab execution cannot be silently promoted into a production host-compromise claim.
Claims & evidence
CLM-VERCEL-SANDBOX-NET-LEAKA researcher demonstrated that packets emitted from Vercel Sandbox could carry host memory into observable network traffic on production sandboxes.supported
Basis: reported finding
- supportsVercel: findings from the one-million-dollar Sandbox challengeprimary disclosure
The kernel zero day; Leaking host memory; Crashing the host and executing code on the host
Implications
This distinction matters because a production memory leak has a different evidentiary scope than a laboratory-only host takeover, even when the cause is related.
Controls and mitigations
- Confirm the actual host kernel mitigation and reproduce the memory-leak test without tenant data; separately test denial and execution paths on owned replicas.
Unknowns and contradictions
- Vercel reported no confirmed customer data access through the challenge. Kernel patches were undergoing coordinated review at disclosure and no public CVE was yet supplied. Do not infer all Firecracker installations share the same vulnerable kernel configuration.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile