AIKIDO-2026-37276

TL;DR

Pooled SandboxPool hosts in huggingface-hub used one job wide X-Sandbox-Token for every sandbox on a host, and proxy_headers passed that host credential to browsers or WebSocket clients. Discovered hosts were taken from Job labels without binding initiator, image, flavor, command, or URL, and the local pool cache was keyed only by pool id, so Hub credentialed requests could go to a spoofed or cross context host. A leaked or misdelivered host token authorized every current and future sandbox on that host, including pool management. The fix mints a random per sandbox capability token for pooled operations, checks discovered hosts before sending credentials, and keys the cache by endpoint, credential, and namespace.