Loading vulnerability…
TOCTOU Symlink Race in Docker Sandboxes Unix-Socket Relay
CVE-2026-79994 is a time-of-check to time-of-use race condition in the guest-to-host Unix-domain socket relay in Docker Sandboxes versions 0.37.0 through versions before 0.42.0. The relay validates that a requested socket pathname lies within an authorized workspace, but subsequently establishes the connection by resolving that pathname again. A malicious guest can replace an intermediate directory with a symbolic link between validation and the host-side connect() operation, redirecting the connection to an AF_UNIX socket outside the authorized workspace. Successful exploitation can expose data or host-side capabilities available through the targeted socket.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation bypasses the relay's workspace restriction and exposes host services that were not authorized for guest access. Confidentiality and integrity consequences depend on the targeted service's functionality, privileges, protocol, and authentication controls. Sensitive information or administrative capabilities may become accessible, but the vulnerability does not inherently grant unrestricted host filesystem access or arbitrary code execution.
If you can’t patch tonight, do this now.
If upgrading is temporarily impossible, recreate sandboxes using clone mode and avoid additional read-write host mounts. Clone mode requires a Git repository and exposes the source repository read-only while the guest works in a private clone, preventing the shared-directory modifications needed for the described race. Clone mode is not a confidentiality boundary: repository contents, including untracked sensitive files, remain readable by the guest.
Patch, then assume compromise.
Upgrade Docker Sandboxes to version 0.42.0 or a later patched release. The initially published designation of version 0.41.0 as the first fixed release was corrected to 0.42.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.