Critical Docker Sandbox Vulnerabilities Let Guests Escape microVMs

Key Takeaways

• Docker has addressed two critical vulnerabilities, CVE-2026-77179 and CVE-2026-79994, in its Docker Sandboxes product.
• These flaws could allow malicious guest workloads to escape their isolated microVM environments and access sensitive host system resources.
• The vulnerabilities specifically impact Docker Sandboxes versions prior to 0.42.0, with one critical flaw affecting macOS users.
• A fix is available in Docker Sandboxes version 0.42.0, released on September 7.

Docker has issued patches for two severe vulnerabilities within its Docker Sandboxes offering. These security flaws presented a risk where a malicious guest workload could bypass its intended isolated workspace, potentially gaining access to sensitive resources on the host system.

The identified vulnerabilities, cataloged as CVE-2026-77179 and CVE-2026-79994, have been resolved with the release of Docker Sandboxes version 0.42.0 on September 7.

Docker Sandboxes is designed to execute potentially untrusted workloads, such as code snippets and AI agent tasks, within isolated microVM environments. The core security principle relies on a strict separation between the guest environment and the host’s files, sockets, and services. Both recently patched vulnerabilities compromised this crucial boundary through insecure handling of filesystem paths.

CVE-2026-77179: Critical Host File Manipulation

CVE-2026-77179, rated as Critical, impacted Docker Sandboxes versions ranging from 0.28.0 up to, but not including, 0.42.0 specifically on macOS systems. This particular issue resided within the virtio-fs host server, a component responsible for facilitating file sharing between a sandbox guest and the host system.

The vulnerability stemmed from the component’s ability to follow symbolic links when re-opening a file that had been unlinked from a previously stored path. An attacker operating within a guest environment could exploit a race condition by replacing a parent directory with a symbolic link after the initial path was recorded by the system. This manipulation could redirect a subsequent file operation to an unintended location outside the approved shared workspace.

Successful exploitation of this flaw could enable a malicious guest to read or modify arbitrary files on the host system, provided they were accessible to the virtual machine monitor (VMM) user. The ability to alter sensitive host files could ultimately lead to remote code execution, escalating the impact from a workspace escape to a full compromise of the underlying macOS host.

CVE-2026-79994: High-Severity Unix Socket Misdirection

The second vulnerability, CVE-2026-79994, received a High severity rating and affected Docker Sandboxes versions from 0.37.0 up to, but not including, 0.42.0. This flaw was associated with the guest-to-host Unix domain socket relay, a mechanism that permits a sandbox to communicate with authorized Unix sockets on the host side.

The relay mechanism initially verified that a socket path was located within an authorized workspace. However, it subsequently reconnected using the original path name rather than a securely retained file reference. This time-of-check to time-of-use (TOCTOU) condition allowed a malicious guest to introduce a symbolic link in an intermediate directory between the verification and connection steps.

Such an exploit could force the host to connect to an arbitrary AF_UNIX socket situated outside the intended workspace. Depending on the specific socket targeted, an attacker could potentially expose sensitive data or gain unauthorized access to host-side functions available through that service.

These recent disclosures follow other Docker security fixes in 2026, including CVE-2026-17106, a destination-escape issue in docker container cp resolved in Docker Desktop 4.86.0. This recurring pattern underscores the critical importance of promptly applying security updates and minimizing host filesystem exposure in development workflows that utilize containers and microVMs.

What You Should Do

• Immediately upgrade Docker Sandboxes to version 0.42.0 or later. This is particularly crucial for macOS users running untrusted code, integrating third-party repositories, or deploying autonomous AI workloads.
• If an immediate upgrade is not feasible, Docker recommends utilizing clone mode and avoiding read-write host mounts as temporary mitigation strategies.
• Regularly monitor Docker’s official security advisories and announcements for new updates and best practices.
• Review and enforce strict access controls and least privilege principles for all Docker environments, especially those handling potentially untrusted workloads.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.