Threat Intelligence Database

CVE-2026-79994 is a high-severity TOCTOU race condition vulnerability in Docker Sandboxes. It involves the guest-to-host Unix-domain socket relay, which validates socket paths but later reconnects using the pathname. A malicious guest can exploit this timing gap by replacing an intermediate directory with a symlink after validation, causing the host to connect to an unauthorized socket outside the shared workspace. This can lead to exposure of data or host-side capabilities accessible via the targeted socket.

CVE-2026-17106, known as CopyEscape, is a high-severity vulnerability in Docker's 'docker cp' command that allows a malicious container to write arbitrary files to the host filesystem. The flaw stems from a filesystem race condition during archive creation combined with unsafe symbolic link handling during extraction. This can lead to arbitrary file creation or overwriting on the host and potentially code execution depending on the privileges of the Docker CLI user. Docker has released official fixes in Docker Engine/CLI version 29.7.2 and later, Docker Desktop 4.86.0 and later, and Docker Sandboxes 0.38.0 and later.

Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.