SB2026091647 - Multiple vulnerabilities in Docker Sandboxes

Description

This security bulletin contains information about 2 vulnerabilities.

1) Link following (CVE-ID: CVE-2026-77179)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify arbitrary host files.

The vulnerability exists due to improper handling of symbolic links in the virtio-fs host server on macOS when reopening an unlinked file from a stored path. A local user can replace a parent directory with a symbolic link to escape the shared workspace and read or modify arbitrary host files.

This may potentially lead to code execution on the host.

2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-79994)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose data or access host-side capabilities.

The vulnerability exists due to a time-of-check time-of-use race condition in the guest-to-host Unix domain socket relay when reconnecting to a Unix domain socket after validating its path. A local user can replace an intermediate directory with a symbolic link between the path check and connection to cause the host to connect to an arbitrary AF_UNIX socket outside the shared workspace.

Remediation

Install update from vendor's website.

References

• https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994
• https://docs.docker.com/ai/sandboxes/release-notes/#0420