Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files
Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.
Docker patched CVE-2026-77179 (Critical) and CVE-2026-79994 (High) in Docker Sandboxes 0.42.0, released September 7. Both are time-of-check-to-time-of-use symlink races: CVE-2026-77179 in the macOS virtio-fs host server (versions 0.28.0 to before 0.42.0) can allow a malicious guest to read or modify arbitrary host files and potentially achieve code execution, while CVE-2026-79994 in the guest-to-host Unix socket relay (0.37.0 to before 0.42.0) can redirect host connections to arbitrary AF_UNIX sockets. Docker recommends upgrading and, as interim mitigation, using clone mode and avoiding read-write host mounts.
- CVE-2026-77179 (Critical): macOS virtio-fs symlink race enables workspace escape, arbitrary host file read/write, possible code execution
- CVE-2026-79994 (High): Unix socket relay symlink race redirects host connections to arbitrary AF_UNIX sockets
- Both fixed in Docker Sandboxes 0.42.0; interim mitigations include clone mode and avoiding read-write host mounts
- Flaws heighten risk in AI-agent workflows where sandboxes run untrusted code and dependencies
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-17106 | Path Traversal via Link Following in Moby go-archive Tar Extraction | 7.1 | <1% | ||
| CVE-2026-2664 | An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0… | 6.8 | <1% | ||
| CVE-2026-28400 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker | 7.5 | <1% | ||
| CVE-2026-33990 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker | 6.8 | <1% | ||
CVE-2026-5817+1 related CVE | The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without… | 8.8 | <1% | ||
CVE-2026-77179+1 related CVE | Symlink Escape in Docker Sandboxes virtio-fs Exposes macOS Host Files | 9.4 group max | <1% | PoC |
From the original article
3 min read at gbhackers.com
Docker has released security fixes for two serious vulnerabilities in Docker Sandboxes that could let a malicious guest environment bypass workspace isolation and access sensitive resources on the host. These flaws, identified as CVE-2026-77179 and CVE-2026-79994, were addressed in Docker Sandboxes version 0. 42.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.