Full Report
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions
Analysis Summary
# Vulnerability: Docker Sandboxes File System Escape and Socket Relay Flaw
## CVE Details
- **CVE ID:** CVE-2026-77179 (Primary) / CVE-2026-79994 (Secondary)
- **CVSS Score:** 9.4 (Critical) / 8.7 (High)
- **CWE:** Link Following (Symlink Race Condition/TOCTOU)
## Affected Systems
- **Products:** Docker Sandboxes (AI coding agent environments)
- **Versions:**
- **CVE-2026-77179:** 0.28.0 up to (but not including) 0.42.0
- **CVE-2026-79994:** 0.37.0 up to (but not including) 0.42.0
- **Configurations:**
- **CVE-2026-77179:** Confirmed for macOS hosts.
- **CVE-2026-79994:** Platform not specified (likely all supported platforms including Windows/Linux).
- Affects environments where the project directory is shared into the sandbox with read-write access.
## Vulnerability Description
CVE-2026-77179 resides in the **virtio-fs host server**, which manages file sharing between the macOS host and the sandbox VM. The server failed to properly validate paths when reopening files that had been removed. A malicious guest (or compromised AI agent) could replace a parent directory with a symbolic link. Because the host server followed these symlinks, it allowed the guest to escape the designated workspace and access or modify files anywhere on the host system with the privileges of the user running the VM.
CVE-2026-79994 involves a **Time-of-Check to Time-of-Use (TOCTOU)** flaw in the Unix domain socket relay. The relay verified a socket path was inside the workspace but failed to prevent a symlink substitution before the actual connection was established, allowing connections to sockets outside the authorized workspace.
## Exploitation
- **Status:** Not exploited (No reports of exploitation in the wild; not in CISA KEV catalog).
- **Complexity:** Medium (Requires executing malicious code within the sandbox environment).
- **Attack Vector:** Local (Code must already be running inside the guest VM).
## Impact
- **Confidentiality:** High (Host files can be read).
- **Integrity:** High (Host files can be modified; potential for host-side code execution).
- **Availability:** High (Host files can be deleted or altered to disrupt service).
## Remediation
### Patches
- **Update to Docker Sandboxes version 0.42.0 or later.**
- Version **0.43.0** (released Sept 15) is the most recent stable release and includes all fixes.
### Workarounds
If updating is not immediately possible:
1. **Use Clone Mode:** Create sandboxes using the `--clone` flag. This mounts the repository as read-only at `/run/sandbox/source`.
2. **Avoid Host Mounts:** Do not add additional read-write host mounts to the sandbox.
3. **Recreate Sandboxes:** Existing sandboxes must be removed and recreated with the protective flags, as these settings are applied at creation.
## Detection
- **Indicators of Compromise:** Unusual file access patterns originating from the Docker VMM process; creation of unexpected symbolic links within shared project directories.
- **Detection methods:** Monitor host-side file system integrity and review audit logs for the user account running Docker Sandboxes.
## References
- **Vendor Advisory:** [https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994]
- **CVE-2026-77179 Record:** [https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/77xxx/CVE-2026-77179.json]
- **Release Notes:** [https://github.com/docker/sbx-releases/releases/tag/v0.42.0]