Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files

Docker has released security fixes for two serious vulnerabilities in Docker Sandboxes that could let a malicious guest environment bypass workspace isolation and access sensitive resources on the host.

These flaws, identified as CVE-2026-77179 and CVE-2026-79994, were addressed in Docker Sandboxes version 0.42.0, which was released on September 7.

Docker Sandboxes isolate development agents and workloads while selectively sharing a host workspace. Both vulnerabilities arise from improper handling of pathnames after an authorization decision: a compromised sandbox could exploit symbolic links to alter a directory path between the validation and subsequent host-side access.

Docker Sandboxes Vulnerabilities

CVE-2026-77179 is rated Critical and affects Docker Sandboxes versions 0.28.0 through versions before 0.42.0 on macOS. This issue exists in the macOS virtio-fs host server, which incorrectly follows symbolic links when reopening an unlinked file that is based on a previously stored path.

A malicious process inside a guest sandbox could replace a parent directory with a symbolic link after the original path has been approved.

This race condition could redirect a subsequent host-side file operation outside the authorized shared workspace. According to Docker, a successful exploit could allow a malicious guest to read or modify arbitrary host files accessible to the virtual machine monitor (VMM) user. This access could potentially lead to host code execution.

The flaw is particularly significant in developer and AI-agent workflows, where sandboxes often handle untrusted repositories, generated code, third-party tools, or software dependencies.

A sandbox’s effectiveness relies on restricting all subsequent filesystem operations to the originally authorized directory object, rather than re-evaluating an attacker-modified pathname.

CVE-2026-79994, rated High, affects Docker Sandboxes versions 0.37.0 through versions before 0.42.0 across affected deployments. This vulnerability pertains to the guest-to-host Unix domain socket relay.

While Docker Sandboxes originally verified that a requested socket path was within an approved workspace, it subsequently established the connection using the original path string. An attacker could exploit the gap between these two operations by replacing an intermediate directory with a symbolic link.

This could lead the host to connect to an arbitrary AF_UNIX socket located outside the shared workspace. Depending on the service linked to the targeted socket, the consequences could include data disclosure or unintended access to host-side functions that are exposed through that socket.

Unlike conventional network service exposures, Unix sockets often provide local inter-process communication (IPC) interfaces for privileged applications, development tools, or platform services. This vulnerability underscores the risks of treating pathname validation as a one-time security control, especially when the path can be altered before use.

CVE Details

CVE	Product / Component	Severity	Affected Versions	Security Impact	Fixed Version
CVE-2026-77179	Docker Sandboxes virtio-fs host server on macOS	Critical	0.28.0 to before 0.42.0	Symlink race enables workspace escape and arbitrary VMM-user file read/write; may lead to host code execution	0.42.0
CVE-2026-79994	Docker Sandboxes guest-to-host Unix socket relay	High	0.37.0 to before 0.42.0	Symlink race can redirect a host connection to an unauthorized AF_UNIX socket	0.42.0
CVE-2026-17106	Docker Desktop docker container cp	Not stated	Docker Desktop versions before 4.86.0	Destination-escape flaw	4.86.0
CVE-2026-5843	Docker Model Runner MLX backend	Not stated	Docker Desktop versions before 4.71.0	Container-to-host code execution	4.71.0
CVE-2026-5817	Docker Model Runner vllm-metal backend	Not stated	Docker Desktop versions before 4.68.0	Container-to-host code execution	4.68.0
CVE-2026-33990	Docker Model Runner OCI Registry Client	Not stated	Docker Desktop versions before 4.67.0	Server-side request forgery	4.67.0
CVE-2026-28400	Docker Model Runner	Not stated	Docker Desktop versions before 4.62.0	Runtime flag injection	4.62.0
CVE-2026-2664	gRPC-FUSE kernel module	Not stated	Docker Desktop versions before 4.62.0	Out-of-bounds read	4.62.0

Organizations should upgrade Docker Sandboxes to version 0.42.0 or later immediately. Docker’s subsequently released 0.43.0 also contains additional security hardening and workspace-related improvements.

Where an immediate upgrade is not possible, Docker recommends using clone mode and avoiding read-write host mounts. Clone mode reduces direct exposure of the host workspace, while removing writable mounts limits the damage that could result if a malicious guest achieves path redirection.

Security teams should also treat sandboxes executing untrusted code as potentially hostile, minimize host-mounted directories, avoid placing credentials or sensitive repositories in shared paths, and monitor Docker Sandboxes version deployment across macOS developer endpoints.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC