CopyEscape Vulnerability in Docker Allows Host File Overwrites and Root Access

A newly disclosed Docker vulnerability, tracked as CVE-2026-17106 and nicknamed “CopyEscape,” allows malicious containers to overwrite files on the host machine and, in certain configurations, achieve full root code execution. The flaw was discovered by the Imperva Red Team and affects the widely used docker cp command, along with the related sbx cp command used in Docker Sandboxes for AI-agent workflows. If exploited, CopyEscape allows a malicious container to escape its isolated environment, write or overwrite arbitrary files on the client host, and, under specific conditions on Linux, achieve root-level code execution.

The vulnerability resides within Docker's archive pipeline, the mechanism responsible for transferring files between a container and the host. When a user executes a command like docker cp container:/path/to/file.txt ./file.txt, Docker does not perform a direct filesystem copy. Instead, the Docker daemon traverses the container's live filesystem, packages the specified path into a tar archive, and then hands this archive to the Docker CLI for extraction on the local machine. This process relies on two key assumptions: that the daemon produces a consistent archive and that the CLI keeps all extracted files within the user-specified destination.

Imperva's researchers identified a method to subvert both of these assumptions within a single copy operation by chaining a filesystem race condition with flawed symlink validation. Because Docker only locks its internal state during the archive walk and not the processes running within the container, an attacker can manipulate files while the scan is in progress. Through a precisely timed sequence of directory swaps, a malicious container can trick Docker's walker into recording a directory, only to replace it with a symlink pointing outside the intended destination, such as to /usr/bin.

Further complicating matters, a validation check within Docker's extraction code inspects one constructed path but ultimately creates a symlink using a different, unchecked path from the archive. This mismatch allows the attacker's files to be written to any location the symlink points to, effectively bypassing the sandbox entirely. On macOS, where Docker Desktop runs its daemon within a virtual machine, the CLI still extracts files locally. This means attackers could overwrite shell startup scripts, SSH configurations, or LaunchAgents to achieve code execution the next time a terminal session is initiated.

On Linux systems, if docker cp is executed with elevated privileges, which is common in automation environments, this file write primitive can be used to replace critical system binaries like runc. This effectively transforms a file overwrite into immediate root-level access. The researchers also confirmed that the flaw impacts Docker Sandboxes' sbx cp command, exposing AI-coding-agent environments to the same destination-escape risks when retrieving files from untrusted sandboxes.

Docker has addressed this vulnerability by releasing patches in Docker Engine and CLI version 29.7.2, Docker Desktop version 4.86.0, and Docker Sandboxes version 0.38.0. The disclosure process, which began in April 2026, required several extensions to resolve regressions from an earlier fix. Organizations unable to upgrade immediately are advised to avoid using docker cp with untrusted or live containers, to stop containers before copying files, to eliminate the use of sudo docker cp, and to retrieve suspicious data only through isolated, disposable environments.

The underlying security lesson from CopyEscape is that archive extraction itself constitutes a security boundary. This boundary cannot be reliably maintained solely through path-string checks when symlinks and concurrent file modifications are involved, highlighting the need for more robust validation mechanisms in such operations.