Docker Desktop for macOS Suffers Sandbox Escape Vulnerability
A high-severity sandbox escape vulnerability in Docker Desktop for macOS allows local attackers to break out of the inference server's sandbox and execute arbitrary code on the host system.
Zero Day Initiative (ZDI) has disclosed a critical sandbox escape vulnerability affecting Docker Desktop for macOS, specifically within its inference server component. The flaw, tracked as ZDI-26-451, carries a CVSS score of 8.8, indicating a high level of risk.
This vulnerability allows local attackers who have already achieved low-privileged code execution within the Docker inference server's sandbox to break out of that restricted environment. The exploitability hinges on the attacker first gaining a foothold inside the sandbox, after which they can leverage this newly disclosed flaw to escalate their privileges.
The root cause of the vulnerability lies in a permissive allow list configuration within the sandbox profile for the inference server process. This overly broad list of permitted inputs inadvertently creates a pathway for malicious actors to manipulate the system and escape the intended security boundaries.
Successful exploitation enables an attacker to escalate privileges and execute arbitrary code directly on the host system, operating with the same permissions as the current user. This could lead to significant compromise, including data theft, system manipulation, or the deployment of further malicious software.
Docker has acknowledged the vulnerability and has released an update to address the issue. Security researchers at TrendAI Research, specifically Nitesh Surana, are credited with discovering and reporting the flaw. The disclosure timeline indicates the vulnerability was reported in February 2026 and publicly disclosed in July 2026.
Details of the fix can be found in a commit to the Docker model-runner GitHub repository, which outlines the specific changes made to rectify the permissive allow list. Users of Docker Desktop for macOS are strongly advised to update to the patched version to mitigate this risk.
This incident highlights the ongoing challenges in securing containerized environments and the critical importance of robust sandbox configurations. As applications increasingly rely on sandboxing for security, flaws in these isolation mechanisms can have severe consequences, underscoring the need for continuous security auditing and prompt patching.