Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Docker patched two sandbox-escape flaws, CVE-2026-77179 and CVE-2026-79994, letting malicious guest workloads access host files and sockets.
Docker fixed CVE-2026-77179 (Critical), a virtio-fs symlink race in Docker Sandboxes 0.28.0 through before 0.42.0 on macOS that could let a guest read or modify arbitrary host files and potentially reach code execution, and CVE-2026-79994 (High), a time-of-check-to-time-of-use flaw in the guest-to-host Unix socket relay affecting 0.37.0 through before 0.42.0. Fixes shipped in Docker Sandboxes 0.42.0, released September 7; Docker recommends clone mode and avoiding read-write host mounts as interim mitigations. The article also references the earlier destination-escape flaw CVE-2026-17106 in docker cp, fixed in Docker Desktop 4.86.0. No exploitation is reported.
- Both flaws involve unsafe filesystem path and symlink handling
- CVE-2026-77179 could enable arbitrary host file access and possible code execution
- Docker Sandboxes run untrusted code and AI-agent workloads in microVMs
- Fixed in version 0.42.0; clone mode recommended where upgrade is delayed
- Vendors
- Docker
- Products
- Docker SandboxesDocker Desktop
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-17106 | Path Traversal via Link Following in Moby go-archive Tar Extraction | 7.1 | <1% | ||
CVE-2026-77179+1 related CVE | Symlink Escape in Docker Sandboxes virtio-fs Exposes macOS Host Files | 9.4 group max | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
Docker patched two serious vulnerabilities in Docker Sandboxes that could let a malicious guest workload break out of its intended shared workspace and access sensitive host-side resources. The flaws, tracked as CVE-2026-77179 and CVE-2026-79994, were fixed in Docker Sandboxes version 0. 42.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.