Docker fixes critical macOS sandbox escape flaw CVE-2026-77179

September 17, 2026 at 08:37 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Docker patched a critical vulnerability in Docker Sandboxes that allowed malicious code inside a macOS virtual machine to escape the shared project directory and read or modify files anywhere on the host. The flaw, CVE-2026-77179, affected versions 0.28.0 through 0.41.9 and was fixed in version 0.42.0 released September 7. Docker has not reported any exploitation of the vulnerability.

Key Facts

CVE-2026-77179 is rated Critical and affects Docker Sandboxes versions 0.28.0 through 0.41.9 on macOS.
The vulnerability was fixed in Docker Sandboxes version 0.42.0, released on September 7.
The escape runs with the rights of the host account that runs the virtual machine, potentially leading to code execution on the host.
Docker has not reported any exploitation, and CISA's assessment lists exploitation as none as of September 16.
The same release fixes a second flaw, CVE-2026-79994, rated High with a CVSS score of 8.7, affecting versions 0.37.0 through 0.41.9.

Vulnerability Details

The escape goes through the virtio-fs host server, the host side of the file sharing between the Mac and the virtual machine, which followed symlinks when it reopened a removed file from a stored path. A guest could replace a parent directory with a symlink and then read or change files as the VMM user, the host account under which the virtual machine monitor runs. Docker's documentation has said since March that symlinks pointing outside the workspace are not followed. The flaw needs malicious code inside the sandbox, such as a coding agent that has been turned against its user or anything malicious the agent installs and runs.

Second Vulnerability

CVE-2026-79994 is rated High by Docker with a CVSS score of 8.7 and affects versions 0.37.0 through 0.41.9, but not 0.42.0. The flaw is in the relay that allows a sandbox to connect to Unix domain sockets within its authorized workspace. The relay checked that a socket path was inside the workspace, then reconnected using the path name. A guest that replaced a directory along that path with a symlink between the check and the connection could make the host connect to any AF_UNIX socket outside the workspace, exposing data or host-side capabilities provided by that socket.