Loading vulnerability…
Read-only mount bypass in Docker Sandboxes
CVE-2026-18171 is a vulnerability in Docker Sandboxes (sbx) in which the read-only intent for a host-mounted directory is enforced only on the in-guest bind mount, while the corresponding underlying virtio-fs host-edge grant remains allowlisted without an access-mode restriction. As a result, a host directory attached to the sandbox as read-only can still remain writable through the sandbox's shared export path. Unprivileged code running inside the sandbox can derive that alternate path and use it to modify host files despite the operator having mounted the directory read-only. The issue affected Docker Sandboxes versions 0.35.0 through 0.38.0 and was reported across macOS, Linux, and Windows environments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unprivileged code executing inside a Docker Sandbox to bypass intended read-only mount restrictions and perform unauthorized writes to host directories that were expected to be protected from modification. This can enable tampering with source code, build inputs, CI configuration, infrastructure-as-code, or other mounted project artifacts, potentially leading to downstream execution of attacker-controlled changes on the host or in CI/CD workflows, as well as integrity loss of host data.
If you can’t patch tonight, do this now.
Until patched, avoid attaching sensitive host directories to Docker Sandboxes when relying on read-only semantics for protection. Minimize or eliminate host file sharing into sandboxes where possible, especially for source repositories, CI definitions, infrastructure code, and other execution-sensitive assets. Treat sandboxed code and coding agents as capable of modifying any host content exposed through shared exports, and isolate high-trust build or deployment material from sandbox-accessible mounts.
Patch, then assume compromise.
Upgrade Docker Sandboxes to a fixed release that correctly enforces read-only access on both the in-guest bind mount and the underlying virtio-fs host-edge grant. The available information indicates users on vulnerable versions should update to version 0.38.0 or later containing the vendor fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.