Docker recently patched two significant vulnerabilities—CVE-2026-77179 and CVE-2026-79994—in Docker Sandboxes that enabled potentially malicious workloads to escape isolated microVM environments and gain access to sensitive host-side files or services. These flaws result from unsafe handling of filesystem paths and symbolic links, allowing guest code to break free of its sandboxed boundaries.
What Docker Sandboxes Are and Why It Matters
Docker Sandboxes leverage microVM setups to run untrusted workloads—such as third-party code, AI agents, or other isolated tasks—separately from the host system. The security model hinges on strict separation: guest environments should not touch files, sockets, or services on the host unless explicitly allowed. Any weakness in enforcing that separation can lead to serious host-side compromises.
The Two Vulnerabilities Explained
The first issue, CVE-2026-77179, is rated Critical and affects macOS users running Docker Sandboxes versions between 0.28.0 up to but not including 0.42.0. It targets virtio-fs—the component that handles file sharing between guest and host. The vulnerability is a race condition: if a guest storage path is recorded, the guest could later replace a parent directory with a symbolic link and trick subsequent file operations into accessing files outside the allowed workspace. That can allow unauthorized reading or modification of host files, and even code execution if sensitive host components are compromised.
The second flaw, CVE-2026-79994, is rated High and affects versions 0.37.0 through just before 0.42.0. It involves the mechanism that relays Unix domain sockets from guest to host. While Docker first checks that a socket path is authorized, later it reconnects using the original path rather than a secure file reference. During this gap, a symbolic link substitution could redirect the connection to an arbitrary socket outside the permitted workspace. An attacker exploiting this could access host services inadvertently exposed through these sockets.
What to Do and Broader Implications
Users should upgrade immediately to Docker Sandboxes version 0.42.0 or later—especially those on macOS, running code from third parties, or using AI workloads. Where upgrading isn’t immediately possible, Docker recommends using “clone mode” and avoiding writable host mounts to limit exposure. These practices help mitigate filesystem-based escape risks.
The bugs follow earlier Docker security patches in 2026, including CVE-2026-17106, which fixed a destination-escape issue in the “docker container cp” command. Docker’s pattern of fixes underscores the recurring risks tied to container and microVM isolation, particularly when interacting with host filesystems.
This episode reaffirms the need for vigilant patch management, minimal host surface exposure in dev environments, and scrutiny whenever sandboxed workloads have any path or socket access back to the host system.
The vulnerabilities show just how fragile software boundary guarantees can be, especially in ecosystems that emphasize flexibility and speed. What to watch now: whether Docker relays or virtualization-adjacent tools introduce similar path-based races, and whether industry standards around symbolic link and socket validation in sandboxing frameworks get tightened. The path forward likely includes stronger verification of file-handles, hardened path APIs, and more conservative defaults around host-hostile mounts.
