Socket Relay Vulnerability in Docker Sandbox Products

CVE-2026-79994

What is CVE-2026-79994?

A vulnerability exists in Docker Sandboxes where the guest-to-host Unix-domain socket relay fails to securely validate socket paths. Although it checks that the path is within an authorized workspace, it subsequently reconnects using the provided pathname. An attacker on the guest can exploit this by replacing an intermediate directory with a symlink, leading the host to inadvertently connect to an arbitrary AF_UNIX socket outside the intended shared workspace. This could potentially expose sensitive data or capabilities of the host system that are accessible through the targeted socket.

News Articles

The Hacker News

CVE-2026-79994CVE-2026-77179

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Docker Sandboxes flaws can expose host files or Unix sockets outside the workspace; both were fixed in 0.42.0, with no exploitation reported

3 weeks ago

Cybersecuritynews

CVE-2026-77179CVE-2026-79994

Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces

Docker patched two serious Sandbox vulnerabilities that could let malicious guest workloads escape their isolated workspace and access sensitive host resources.

3 weeks ago

References