Critical CopyEscape Docker Vulnerability Exposes Host Files to Root Overwrite

Key Takeaways

• A critical Docker vulnerability, dubbed “CopyEscape” (CVE-2026-17106), enables malicious containers to overwrite host machine files.
• The flaw impacts the widely used docker cp command and sbx cp in Docker Sandboxes, posing risks to CI/CD pipelines, developer workstations, and AI agent environments.
• Exploitation can lead to root-level code execution on Linux under specific configurations and local code execution on macOS.
• Patches are available in Docker Engine and CLI 29.7.2, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0.

Critical “CopyEscape” Docker Vulnerability Exposes Host Files to Root Overwrite

A newly identified security flaw in Docker, designated CVE-2026-17106 and branded “CopyEscape,” presents a significant risk, allowing rogue containers to overwrite arbitrary files on the host system. Under specific conditions, this vulnerability can escalate to full root code execution on Linux hosts.

Discovery and Scope of the Vulnerability

The Imperva Red Team uncovered this critical vulnerability, which resides within the core functionality of the docker cp command. This command is central to transferring files between Docker containers and their host machines. The flaw also extends to the sbx cp command, which is utilized in Docker Sandboxes for AI agent workflows, broadening its potential impact.

If successfully exploited, CopyEscape permits a malicious container to break out of its intended isolation. This escape facilitates the writing or overwriting of any file on the client host. Furthermore, on Linux systems, this file manipulation can, in certain configurations, be leveraged to achieve root-level privileges.

How CopyEscape Works: A Race Condition in the Archive Pipeline

The vulnerability’s root cause lies within Docker’s archive pipeline, the underlying mechanism responsible for moving files between a container and the host. When a user executes a command like docker cp container:/path/to/file.txt ./file.txt, Docker doesn’t perform a direct filesystem copy. Instead, the Docker daemon traverses the container’s live filesystem, bundles the specified path into a tar archive, and then transmits this archive to the Docker CLI for extraction on the local machine.

This design operates on two fundamental assumptions: that the daemon consistently generates a sound archive, and that the CLI confines all extracted files strictly within the user-specified destination. Imperva’s researchers devised a method to subvert both of these assumptions within a single copy operation.

The exploit cleverly combines a filesystem race condition with a faulty symlink validation check. Docker’s architecture only locks its internal state during the archive traversal, leaving processes running inside the container vulnerable to manipulation. An attacker can exploit this window by manipulating files mid-scan.

Through a precisely timed sequence of directory swaps, a malicious container can deceive Docker’s walker. The walker initially records a legitimate directory, which the attacker then covertly replaces with a symbolic link pointing to an arbitrary location outside the intended destination, such as /usr/bin.

A critical flaw in Docker’s extraction code allows this bypass. While a validation check inspects one constructed path, the system ultimately creates a symlink using a different, unverified path from the archive. This discrepancy enables the attacker’s files to be placed wherever the symlink directs, completely circumventing the container’s sandbox.

Widespread Impact on Development and Operations

Given that docker cp is integral to common tasks such as collecting build artifacts, logs, and forensic evidence, the CopyEscape vulnerability directly jeopardizes CI/CD pipelines, developer workstations, and incident response workflows. Ironically, an analyst attempting to gather evidence from a compromised container could inadvertently trigger the exploit themselves.

On macOS, where Docker Desktop runs its daemon within a virtual machine, the CLI still extracts files locally. This means attackers could overwrite critical files like shell startup scripts, SSH configurations, or LaunchAgents, leading to code execution the next time a terminal session is initiated.

For Linux systems, if docker cp is executed with elevated privileges—a common practice in automated environments—the same file overwrite primitive can be used to replace system binaries, such as runc. This transforms a simple file overwrite into immediate root access.

Researchers also confirmed the flaw impacts Docker Sandboxes’ sbx cp command. This exposes environments hosting AI coding agents to the same destination-escape risk when retrieving files from untrusted sandboxes.

Docker has since released patches for this issue across its product line. This includes Docker Engine and CLI version 29.7.2, Docker Desktop version 4.86.0, and Docker Sandboxes version 0.38.0. The disclosure process, which began in April 2026, required several extensions due to regressions encountered during earlier fix attempts.

The core lesson from this vulnerability underscores that archive extraction itself functions as a security boundary. Relying solely on path-string checks is insufficient to guarantee security when symbolic links and concurrent file modifications are introduced.

What You Should Do

• Upgrade Immediately: Apply the latest Docker patches. Update to Docker Engine and CLI 29.7.2, Docker Desktop 4.86.0, and Docker Sandboxes 0.38.0 or newer.
• Avoid Untrusted Containers: Refrain from using docker cp against untrusted or live containers until systems are fully patched.
• Stop Containers Before Copying: If immediate patching is not possible, stop containers before performing any file copy operations using docker cp.
• Eliminate Elevated Privileges: Review and remove any instances of sudo docker cp, especially in automated scripts, to prevent privilege escalation.
• Isolate Forensic Workflows: When retrieving potentially malicious data, use isolated, disposable environments that cannot impact your host system.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.