Loading story…
A vulnerability in Docker Sandboxes allowed code running inside a sandbox to bypass a read-only mount and modify host files through an alternate writable path, creating a path for tampering with source code, CI configuration, infrastructure-as-code, and other build inputs that could later execute on the host or in CI pipelines. The flaw, tracked as CVE-2026-18171 with a CVSS 5.7 score, affected versions 0.35.0 through 0.38.0 across macOS, Linux, and Windows.
The issue stemmed from the same host directory being exposed twice: as a read-only VirtioFS mount at a user-specified path and as a writable Docker host export under /mnt/host. Researchers demonstrated exploitation on Windows 11 using PowerShell, showing that a compromised coding agent or attacker-controlled code inside the sandbox could write to files that users expected to be protected. Docker reproduced the behavior, fixed the vulnerability, and released a patch on August 12, 2026.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Docker released a fix for the vulnerability affecting Docker Sandboxes versions 0.35.0 through 0.38.0 and issued CVE-2026-18171. The flaw allowed files exposed as read-only through VirtioFS to still be modified through the writable /mnt/host path.
Docker Security reproduced the reported issue and planned a fix for the read-only mount bypass in Docker Sandboxes.
Aikido reported a vulnerability in Docker Sandboxes that allowed bypassing a read-only mount via an alternate writable host path. Docker acknowledged the report the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Imperva disclosed **CopyEscape**, tracked as `CVE-2026-17106`, a container-to-host arbitrary file-write vulnerability in Docker’s `docker cp` functionality that allows a malicious container to create or overwrite files outside the destination chosen by the user on the machine running the Docker CLI. The issue stems from a filesystem race in Docker’s archive creation path combined with unsafe symlink handling during extraction, turning a routine file copy from a container into a host write primitive. Docker confirmed the same CVE also affects `sbx cp` in Docker Sandboxes when copying files out of sandboxes. Imperva said exploitation was validated against Docker Engine `29.6.1` on Linux and Docker Desktop `4.81.0` on macOS, with impact ranging from compromise of the developer account using the CLI to **root code execution** when `docker cp` is run with elevated privileges. Fixes are available in Docker Engine and CLI `29.7.2` or later, Docker Desktop `4.86.0` or later, and Docker Sandboxes `0.38.0` or later.
Aug 12, 2026
Zero Day Initiative disclosed two **Docker Desktop for Windows** privilege-escalation flaws after Docker rejected the reports as outside its threat model. The first issue, tracked as **ZDI-26-258** / `ZDI-CAN-27229`, affects the `extension-manager` component and is caused by an exposed dangerous function in Docker Extensions. ZDI said an attacker who can already execute high-privileged code inside a container could exploit the flaw to run arbitrary code on the Windows host as **SYSTEM**. The advisory lists no assigned CVE and a **CVSS 8.2** score, and credits **Nitesh Surana of TrendAI Research** with the discovery. A second advisory, **ZDI-26-260** / `ZDI-CAN-27571`, describes an uncontrolled search path issue in the Docker Desktop `system/editor` endpoint caused by execution of a program from an unsecured location. ZDI said exploitation requires an attacker to first escape the container and execute high-privileged code inside the Docker **Hyper-V VM**, after which arbitrary code can be run on the host in the context of the current user; the flaw carries a **CVSS 7.5** score. The issue was reported to Docker in July 2025 by **Nitesh Surana and Nelson William Gamazo Sanchez of TrendAI Research**, but was later published as a 0-day after the vendor declined to address it because it depended on prior privileged access.
Jun 29, 2026
Docker disclosed a high-severity Docker Engine vulnerability, **CVE-2026-34040** (`CVSS 8.8`), that allows attackers to bypass authorization plugins and perform actions that should be blocked. The flaw stems from an incomplete fix for **CVE-2024-41110** and is triggered when a specially crafted oversized Docker API request causes the request body to be dropped before inspection by an AuthZ plugin. In affected environments, the plugin may approve container operations it would otherwise deny, opening a path to unauthorized privileged actions and potential host compromise. Researchers said an attacker with Docker API access could exploit the bug by padding a container-creation request beyond **1 MB** to launch a privileged container with access to the host filesystem, exposing sensitive assets such as **AWS credentials**, **SSH keys**, and **Kubernetes configurations**. The issue affects deployments that rely on authorization plugins inspecting request bodies, while environments not using those plugins are not impacted. Docker patched the vulnerability in **Docker Engine 29.3.1** and urged defenders to upgrade, restrict Docker API access, avoid AuthZ plugins that depend on request-body inspection, and use controls such as rootless mode, user namespace remapping, and least-privilege access to reduce risk.
Jul 23, 2026