Docker patched two serious vulnerabilities in Docker Sandboxes that could let a malicious guest workload break out of its intended shared workspace and access sensitive host-side resources.
The flaws, tracked as CVE-2026-77179 and CVE-2026-79994, were fixed in Docker Sandboxes version 0.42.0, released on September 7.
Docker Sandboxes uses isolated microVM environments to run potentially untrusted workloads, including code and AI-agent tasks. The security model depends on strict separation between the guest environment and files, sockets, and services on the host. Both vulnerabilities weaken that boundary through unsafe handling of filesystem paths.
CVE-2026-77179 is rated Critical and affects Docker Sandboxes versions 0.28.0 through versions before 0.42.0 on macOS. The issue exists in the virtio-fs host server, which provides file-sharing capabilities between a sandbox guest and the host system.
Docker Sandboxes Vulnerabilities
The vulnerable component could follow symbolic links when reopening an unlinked file from a previously stored path. An attacker controlling a guest could replace a parent directory with a symlink after the initial path was recorded.
This race condition could redirect a later file operation outside the approved shared workspace. Successful exploitation could let the malicious guest read or alter arbitrary host files accessible to the virtual machine monitor, or VMM, user.
Because modification of sensitive host files can create a path to code execution, the impact could extend from workspace escape to compromise of the underlying macOS host.
The second flaw, CVE-2026-79994, is rated High and affects Docker Sandboxes versions 0.37.0 through versions before 0.42.0. It involves the guest-to-host Unix domain socket relay. This mechanism allows a sandbox to communicate with authorized host-side Unix sockets.
The relay first verified that a socket path was located within an authorized workspace. However, it later reconnected using the original path name instead of a securely retained file reference. Between verification and connection, a malicious guest could replace an intermediate directory with a symlink.
This time-of-check to time-of-use condition could cause the host to connect to an arbitrary AF_UNIX socket outside the intended workspace.
Depending on the targeted socket, an attacker might expose data or access host-side functions available through that service.
Organizations using Docker Sandboxes should upgrade to version 0.42.0 or later immediately, especially macOS users running untrusted code, third-party repositories, or autonomous AI workloads. Docker recommends using clone mode and avoiding read-write host mounts where an immediate upgrade is not possible.
The disclosures follow other Docker security fixes in 2026, including CVE-2026-17106, a destination-escape issue in docker container cp fixed in Docker Desktop 4.86.0.
The pattern reinforces the importance of applying updates promptly and minimizing host filesystem exposure in container- and microVM-based development workflows.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces appeared first on Cyber Security News.