Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Docker patched two sandbox-escape flaws, CVE-2026-77179 and CVE-2026-79994, letting malicious guest workloads access host files and sockets.
62
CVE-2026-77179
Symlink Escape in Docker Sandboxes virtio-fs Exposes macOS Host Files
- CVSS 4.0
- 9.4 critical
- EPSS
- <1%p10
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A symlink-resolution flaw (CWE-59) in the virtio-fs host server used by Docker Sandboxes on macOS allows a malicious guest VM to break out of its shared workspace. The bug occurs when the host server reopens an unlinked file from a stored path: the guest can replace a parent directory with a symlink so the reopen resolves outside the intended share. A successful exploit lets the guest read or modify arbitrary files on the macOS host as the VMM user, with potential host code execution, reflected in a CVSS 4.0 score of 9.4 (critical). This affects users running Docker's Sandboxes feature on macOS hosts, particularly where the sandbox is used to execute untrusted or AI-generated code. No public proof of concept is known and the flaw is not listed in CISA's KEV, so exploitation status is none known.
What to do: Update Docker Desktop on macOS to the latest release, which contains Docker's fix for the virtio-fs symlink handling, as soon as it is available to you. Until patched, disable the Sandboxes feature on macOS hosts and avoid executing untrusted or AI-generated code inside it. If the feature has been used with untrusted code, review the host for unexpected file modifications or processes running as the VMM user.
| Product | Affected |
|---|---|
| Docker Sandboxes (virtio-fs host server on macOS, part of Docker Desktop) | — |
Estimated exposure
moderate≈tens of thousands of macOS Docker Desktop users (opt-in Sandboxes feature) — Docker Desktop has millions of installations and macOS is a major platform, but the Sandboxes feature is opt-in/beta so only a subset of those users run it; no public telemetry exists, so this is a rough order-of-magnitude estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
- Weakness
- CWE-59
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
3 storiesCritical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
56
Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files
Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.
55