Major Security Flaws in Docker Sandboxes Patched

In a significant security update, Docker has addressed two major vulnerabilities within its Sandbox environments, preventing potential exploitation by malicious guests. These vulnerabilities, identified as CVE-2026-77179 and CVE-2026-79994, could have allowed unauthorized access to sensitive host resources.

Details of the Vulnerabilities

The recent release of Docker Sandboxes version 0.42.0 on September 7 marked the resolution of these critical security issues. Docker Sandboxes typically operate using isolated microVMs, designed to run untrusted workloads safely by maintaining a strict separation between guest environments and host resources.

The primary flaw, CVE-2026-77179, is deemed critical and was present in versions 0.28.0 up to those preceding 0.42.0 on macOS. This vulnerability arose from unsafe handling within the virtio-fs host server, which manages file-sharing between sandbox guests and the host system.

Impact and Exploitation Risks

The flaw allowed attackers to exploit symbolic links in file paths, potentially redirecting file operations outside the approved workspace. This race condition could enable unauthorized access to host files, posing risks of code execution and system compromise.

The second vulnerability, CVE-2026-79994, rated as high risk, affected versions from 0.37.0 to those before 0.42.0. It involved the guest-to-host Unix domain socket relay, where a mishandling of path verification could lead to unauthorized socket connections.

This time-of-check to time-of-use vulnerability allowed attackers to manipulate socket path connections, risking exposure of sensitive data or functions.

Recommendations and Future Outlook

Organizations utilizing Docker Sandboxes are urged to update to version 0.42.0 or newer immediately, especially those on macOS executing untrusted code. Docker advises using clone mode and avoiding read-write host mounts as interim precautions if an immediate update isn’t feasible.

These disclosures underscore the necessity for timely updates and reducing host filesystem exposure in container-based workflows. Previous fixes in 2026, such as CVE-2026-17106, further illustrate this critical practice.

Maintaining up-to-date security measures and minimizing vulnerabilities is crucial for protecting technological infrastructures against potential threats.