A Production Sandbox Put Host Memory on the Wire.

Vercel's challenge write-up, dated 14 October 2026, says a standard Vercel Sandbox put host memory into packets on production. Andy Riancho wrote it. Paulos Yibelo (pwn.ai) filed the report on day three, from a standard sandbox with no special access. The post says candidate patches are under private review and CVEs are pending.

Hacker News tonight led with a cancer essay, OpenCode 2.0, and a CSO analysis that summer lab incidents were containment failures. Those incidents already have briefs. US X trends at 22:44 UTC were Champions League names, Starlink, and celebrity. Grok Voice 3.0 trended earlier as a product launch. Reuters in this window had no new operator control failure. Google News for the last two days was mostly the npm trusted-publishing reprints, which already have a brief. The operator fact is this write-up.

High High because the production demonstration put host memory from the shared host onto the wire, and because the post names no kernel version that closes it. The same post keeps the host crash and the administrator commands on the researcher's own machines, and says no report showed a customer's files, secrets, or application data being read.

Host memory is the production fact.#

The 18 August announcement opened a public HackerOne program from 18 August through 1 September 2026, or earlier if the $1,000,000 pool ran out. The 14 October post says $242,000 was paid, so the pool did not run out. The announcement caps one report at $50,000 when it lets someone read or modify another tenant's data. The write-up does not itemize this report's payout.

Yibelo's finding is a defect in the Linux kernel's networking stack. The post lists three results from packets sent inside the microVM. Host memory shows up in packets the guest sends, and that can continue for as long as the guest keeps sending. The host is the machine the sandbox shares with other tenants. That memory result was demonstrated against production sandboxes.

The other two results are a host crash and code execution with full administrator privileges on the host. The crash shut down every sandbox running on that machine. Both results were demonstrated on the researcher's own KVM and Firecracker machines matching the Vercel Sandbox configuration. The post places those two demonstrations on those machines.

Vercel says that after notice it worked with the researcher, with AWS, and with other partners so that Vercel customers and other developers using the kernel were safe. The following sentences say the researcher and the kernel maintainers have candidate patches, the fixes are under private review, CVEs are pending, and Vercel is withholding further detail until the patches are public. The post says it is disclosing the existence because the vulnerability was separately disclosed in public. It does not link that disclosure, and it does not name a kernel version. This brief does not describe the packets.

A patch series from the same researcher has been on the netdev list since 20 September 2026, with a revision dated 21 September. Vercel's post does not cite that series. A mailing-list series is not a deployed host kernel, and it is not a CVE.

The patch clock and the impact clock.#

The impact clock for the memory result sits inside the challenge window. The program opened on 18 August. Vercel says the kernel report arrived on day three, and the snapshot report on day one. The 14 October post does not date the hour the production packets were sent.

The patch clock is still open in public. Private review, and a vendor sentence that customers were made safe, are both in the post. Neither sentence is a version an operator can pin. Cybernews on 5 October already had Rauch's confirmation and no CVE. The vendor post, nine days later, still names none.

Two other findings in the same post have their own clocks.

Marcos Hernanz, a Vercel intern, found a cross-tenant leak in the Linux device-mapper storage layer. Any sandbox could read recycled disk blocks from sandboxes that had been deleted. That section does not say the leak is fixed, and it does not name a date or a build. The snapshot paragraph does not close it.

The snapshot finding was filed on day one. Snapshot creation records where the data landed. That record came from software inside the guest, and services on the host trusted it. The researcher combined a container escape the post calls known and documented with that trust, rewrote the snapshot answer inside a sandbox the researcher controlled, and swapped the storage objects of two snapshots on two accounts the researcher owned. Restoring one snapshot materialized the other account's filesystem. The post says each account could read and modify the other's files. Aiming the swap at a stranger required that victim's snapshot storage key, a random 96-bit identifier generated per snapshot and never exposed through the API. The key appears inside the victim's own sandbox. The post says there was no demonstrated path for a stranger to pick another tenant. Vercel still shipped a fix, because a boundary that depends on a secret staying secret is not a boundary.

The fix shipped within a week of that report. The control plane binds every snapshot object to the project that created it and rejects anything else. Snapshot creation moved out of the guest-reachable environment into a host-side service, and storage paths are project-scoped. The post does not name the release. Trail of Bits flagged the same root cause. Their review spent four engineer-weeks, delivered 20 findings, and calls the virtualization boundary sound: each sandbox has its own Firecracker microVM and a dedicated guest kernel, and no guest shares a running kernel with the host or with another tenant. That architectural sentence and a networking defect a guest can reach are both in the write-up.

The report table is 1,285 reports: 877 duplicates, 319 not applicable, 57 valid, and 32 informative. Triage validated 1 critical, 5 high, 9 medium, 42 low, and 32 informative. The prose calls the kernel defect the most severe finding. Paid bounties are $242,000.

The 12 October allowlist brief is the hostname check and a later fetch by an allowed server. This brief is the challenge close-out.

1. 2026-08-18
   The HackerOne window opens through 1 September. Vercel later calls the snapshot report day one of that window, and the kernel report day three.
2. 2026-09-20
   Yibelo's networking series is on the netdev list. A revision is dated 21 September. The 14 October post does not cite it.
3. 2026-10-05
   Cybernews quotes Rauch confirming a KVM zero-day through the sandbox program. No CVE, and no split of the three results.
4. 2026-10-14
   Vercel publishes the results. Production result: host memory in packets. CVEs pending. Snapshot fix described, with no release number. Disk blocks have no fix line.

What to do while no CVE is named.#

There is no kernel version to upgrade to tonight. When a CVE names a build, that build is the pin. A netdev series the vendor does not cite is not that pin. Do not reconstruct the packets from either write-up.

Keep the production sentence and the customer-data sentence together. Host memory from the shared machine was in the packets during the production demonstration. The post also says no report showed anyone reading a customer's files, secrets, or application data. Host memory and a named customer file are different claims, and the post makes both.

The snapshot fix is described, and the only timing is within a week of a day-one report. If isolation of snapshots between projects is one of your controls, the description to match is a host-side snapshot service and a binding to the project that created the object. The post does not give a region rollout time.

The device-mapper section is a leak with no fix sentence. Treat recycled blocks from deleted sandboxes as open until Vercel names a build or a date.

The August announcement says the host firewall can inject credentials so they never enter the microVM. That control answers a different question from the one the packets raise. Brokering keeps a secret out of the guest. It does not inventory the host memory those packets carried. The post does not say a customer secret was in that memory.

The allowlist finding still has no fixed version of its own. A domain rule that matches a TLS hostname is a separate control from this kernel defect.