Docker Sandboxes Read-Only Mount Bypass Let Sandbox Code Modify Host Files

A vulnerability in Docker Sandboxes allowed code running inside a sandbox to bypass a read-only mount and modify host files through an alternate writable path, creating a path for tampering with source code, CI configuration, infrastructure-as-code, and other build inputs that could later execute on the host or in CI pipelines. The flaw, tracked as CVE-2026-18171 with a CVSS 5.7 score, affected versions 0.35.0 through 0.38.0 across macOS, Linux, and Windows.

The issue stemmed from the same host directory being exposed twice: as a read-only VirtioFS mount at a user-specified path and as a writable Docker host export under /mnt/host. Researchers demonstrated exploitation on Windows 11 using PowerShell, showing that a compromised coding agent or attacker-controlled code inside the sandbox could write to files that users expected to be protected. Docker reproduced the behavior, fixed the vulnerability, and released a patch on August 12, 2026.