Git Configuration Vulnerability in Docker Sandboxes by Docker
CVE-2026-121614

7.1HIGH

Key Information:

Vendor

Docker

Status
Docker Sandboxes
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121614?

Docker Sandboxes versions prior to 0.50.0 have a vulnerability that allows an attacker to exploit repository-controlled Git configurations, resulting in the execution of external programs with the host user's permissions. This occurs during specific host-side Git commands, such as 'clone-mode fetch' or initiated pushes in version 0.39.0 and beyond. If an attacker can modify the Git configuration of a host repository, they can place settings like core.fsmonitor that trigger the execution of programs outside the isolated environment of the microVM. The issue has been addressed in version 0.50.0.

Affected Version(s)

Docker Sandboxes MacOS 0.31.0 < 0.50.0

References

https://docs.docker.com/ai/sandboxes/
product
https://docs.docker.com/ai/sandboxes/security/isolation/
technical-description
https://github.com/docker/sbx-releases/releases/tag/v0.50.0
release-notes

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nitesh Surana (niteshsurana.com) of TrendAI Research
.