A critical security flaw, designated as CVE-2026-17106 and dubbed “CopyEscape,” has been identified in Docker’s file copying mechanism. This vulnerability enables malicious containers to overwrite files on the host system and, under certain conditions, achieve root-level code execution.
Understanding the ‘CopyEscape’ Vulnerability
Docker’s docker cp command facilitates the transfer of files between containers and the host machine. Instead of performing a direct file copy, Docker’s daemon traverses the container’s filesystem, packages the specified files into a tar archive, and then extracts them on the host. This process assumes the archive remains consistent and that extracted files are confined to the intended destination.
However, researchers discovered that by exploiting a race condition and a flawed symlink validation, an attacker can manipulate the file extraction process. By timing directory swaps within the container, a malicious actor can trick Docker into recording a directory, then replace it with a symlink pointing to sensitive host locations, such as /usr/bin. This manipulation allows the attacker’s files to be placed outside the designated extraction path, effectively bypassing Docker’s security measures.
Potential Impact and Affected Systems
The implications of the ‘CopyEscape’ vulnerability are significant:
- CI/CD Pipelines and Developer Workstations: Routine tasks like collecting build artifacts or logs using
docker cpcould inadvertently trigger the exploit, compromising development environments. - macOS Systems: On macOS, where Docker Desktop operates its daemon within a virtual machine, the vulnerability can be exploited to overwrite critical files such as shell startup scripts or SSH configurations, leading to code execution upon the next terminal session.
- Linux Systems: If
docker cpis executed with elevated privileges—a common practice in automated processes—the exploit can replace system binaries, granting immediate root access to the attacker.
Additionally, the vulnerability affects Docker Sandboxes’ sbx cp command, exposing AI-coding-agent environments to similar risks when retrieving files from untrusted sandboxes.
Mitigation and Recommendations
Docker has addressed this vulnerability in the following versions:
- Docker Engine and CLI: 29.7.2
- Docker Desktop: 4.86.0
- Docker Sandboxes: 0.38.0
Organizations are strongly advised to upgrade to these patched versions promptly. For those unable to update immediately, the following precautions are recommended:
- Avoid using
docker cpwith untrusted or active containers. - Stop containers before executing file copy operations.
- Refrain from running
docker cpwith elevated privileges. - Retrieve potentially malicious data only through isolated, disposable environments.
This incident underscores the importance of treating archive extraction as a critical security boundary. Relying solely on path-string checks is insufficient, especially when symlinks and concurrent file modifications are involved. Organizations must remain vigilant and adopt comprehensive security practices to safeguard their containerized environments.
