CVE-2026-121614

Docker Sandboxes host Git operations can escape the agent boundary

Docker · Docker Sandboxes

First documented disclosure · Review checkpoint

Summary

Host Git operations can execute repository-controlled programs outside the agent sandbox.

Severity and exploitation evidence

High · 7.1/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Host-side Git operations could honor executable settings in repository configuration outside the microVM.

Conditions required

An attacker must be able to modify host repository configuration, and a user must perform an affected host Git operation. A read-only sandbox mount alone is insufficient.

Potential impact

Programs can run on the host with the invoking user’s permissions.

Affected versions and configurations

0.31.0 to before 0.50.0.

Fix and mitigation status

0.50.0.

Practical next steps

Upgrade Docker Sandboxes to 0.50.0 and review who can alter host-side repository configuration.

Operating lesson

Constrain host helper processes independently of the sandboxed workload.

Evidence and limits

Docker’s October 26 release notes disclose the host Git change. The November CVE clarifies the required ability to change host-side repository configuration.

Sources