CVE-2026-79994

Docker Sandboxes socket relay can reach unauthorized host Unix sockets

Docker · Docker Sandboxes guest-to-host Unix-domain socket relay

First documented disclosure · Review checkpoint

Summary

A guest can race a workspace path check and make the host connect to a socket outside the workspace.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Docker attributes discovery to an external researcher. Reviewed primary sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The relay validates that a socket path is inside an authorized workspace, then reconnects by pathname. Replacing an intermediate directory with a symlink between validation and connection changes the destination.

Conditions required

A malicious sandbox guest able to manipulate the shared path and win the timing race, plus an accessible target AF_UNIX socket on the host.

Potential impact

Data or host-side capabilities exposed by the targeted Unix socket. The precise impact depends on that service; arbitrary host code execution or root access is not established for every target.

Affected versions and configurations

Docker Sandboxes 0.37.0 through versions before 0.42.0. The CNA does not constrain its affected record to a named operating system.

Fix and mitigation status

Docker Sandboxes 0.42.0, released September 7.

Practical next steps

Upgrade to a supported release containing 0.42.0 fixes. Docker recommends --clone mode and avoiding additional read-write host mounts as workarounds; restrict which host socket capabilities are exposed.

Operating lesson

Bind authorization to the opened resource rather than a mutable pathname when crossing a guest-to-host boundary.

Evidence and limits

September 15 is the verified CNA publication and public documentation commit. The September 7 0.42.0 release predates these disclosures; its present security annotations do not prove earlier publication. CNA-linked implementation PRs in docker/sailor and docker/sandboxes returned 404, so the implementation and an earlier public patch date could not be independently inspected. Do not infer a macOS-only scope from the separate virtio-fs CVE-2026-77179.

Sources