CVE-2026-77179

Docker Sandboxes symlink handling can escape the shared macOS workspace

Docker · Docker Sandboxes for macOS / virtio-fs host server

First documented disclosure · Review checkpoint

Summary

A malicious guest can redirect stored-path file reopening outside its authorized workspace.

Severity and exploitation evidence

Critical · 9.4/10 · CVSS 4.0. Severity source.

Exploitation not established: Docker attributes discovery to an external researcher. Reviewed primary sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

When reopening an unlinked file from its stored path, the virtio-fs host server follows a symlink substituted for a parent directory.

Conditions required

Code execution inside a malicious sandbox guest and an affected shared host workspace; the CVE concerns the macOS host-side filesystem server.

Potential impact

Read or modification of arbitrary host files as the VMM user, potentially leading to host code execution. Host root access is not established.

Affected versions and configurations

Docker Sandboxes for macOS 0.28.0 through versions before 0.42.0.

Fix and mitigation status

Docker Sandboxes 0.42.0, released September 7.

Practical next steps

Upgrade to a supported release containing 0.42.0 fixes. Docker recommends --clone mode and avoiding additional read-write host mounts as workarounds.

Operating lesson

Revalidate filesystem boundaries at the point of use; a path originally inside a workspace may later resolve outside it.

Evidence and limits

September 15 is the verified CNA publication and public Docker documentation commit. The 0.42.0 tag was released September 7, but the current retrospectively annotated release page does not establish that CVE details were public then. Scope is macOS for this CVE; do not transfer the scope or impact of the separate Unix-socket relay CVE-2026-79994. The fixed version addresses this issue and is not a claim that an old release is safe overall.

Sources