Critical Docker Sandbox Vulnerabilities Allow Host Escape on macOS
Two critical vulnerabilities in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, have been patched, enabling malicious guests to escape microVM isolation and access host resources.
Docker has addressed two severe vulnerabilities within its Docker Sandboxes product that posed a significant risk of allowing malicious guest workloads to break out of their isolated microVM environments and access sensitive host resources. These flaws, identified as CVE-2026-77179 and CVE-2026-79994, were resolved in version 0.42.0 of Docker Sandboxes, released on September 7.
Docker Sandboxes are designed to run potentially untrusted code, such as AI agents or custom code snippets, within isolated microVM environments. The security of this model relies heavily on maintaining strict separation between the guest environment and the host's files, network sockets, and services. Both newly patched vulnerabilities undermine this critical boundary through insecure handling of filesystem paths.
The first vulnerability, CVE-2026-77179, is classified as Critical and specifically impacts Docker Sandboxes versions from 0.28.0 up to, but not including, 0.42.0 on macOS systems. This flaw resides within the virtio-fs host server, a component responsible for enabling file-sharing capabilities between a sandbox guest and the host. The vulnerability arises from an unsafe handling of symbolic links when reopening an unlinked file from a previously recorded path.
An attacker controlling a guest workload could exploit this by replacing a parent directory with a symbolic link after the initial path has been recorded. This race condition allows a subsequent file operation to be redirected outside the boundaries of the approved shared workspace. Successful exploitation could grant the malicious guest the ability to read or modify arbitrary host files that are accessible to the virtual machine monitor (VMM) user. Given that modifying sensitive host files can lead to code execution, the impact could escalate from a simple workspace escape to a full compromise of the underlying macOS host.
The second vulnerability, CVE-2026-79994, is rated High and affects Docker Sandboxes versions 0.37.0 through 0.42.0. This flaw is related to the guest-to-host Unix domain socket relay, a mechanism that permits a sandbox to communicate with authorized Unix sockets on the host. The relay mechanism initially verified that a target socket path was located within the authorized workspace. However, it would later attempt to reconnect using the original path name rather than a securely retained file reference.
This time-of-check to time-of-use (TOCTOU) condition could be exploited by a malicious guest. By replacing an intermediate directory with a symbolic link between the verification and connection phases, an attacker could trick the host into connecting to an arbitrary AF_UNIX socket outside the intended workspace. Depending on the specific socket targeted, this could expose sensitive data or allow access to host-side functions exposed through that service.
Docker strongly advises all organizations utilizing Docker Sandboxes to upgrade to version 0.42.0 or a later release immediately. This is particularly crucial for macOS users who are running untrusted code, third-party repositories, or autonomous AI workloads. For those unable to upgrade immediately, Docker suggests employing clone mode and avoiding read-write host mounts as interim mitigation strategies.
These disclosures follow a series of other security fixes for Docker products throughout 2026, including a destination-escape issue in docker container cp (CVE-2026-17106) patched in Docker Desktop 4.86.0. The ongoing nature of these vulnerabilities underscores the critical importance of promptly applying security updates and minimizing host filesystem exposure when working with containerized and microVM-based development workflows.