Critical Docker Sandboxes Flaw Could Allow AI Agents to Escape Virtual Machines
A critical security vulnerability in Docker Sandboxes could allow malicious code running inside a sandboxed virtual machine on macOS to escape the isolation boundary and read or modify files anywhere on the host system.
The vulnerability, tracked as CVE-2026-77179, has been rated Critical with a CVSS score of 9.4.
Docker released a fix in version 0.42.0 on September 7, 2026.
Vulnerability Details
Docker Sandboxes are designed to isolate AI coding agents inside lightweight virtual machines while providing them access to a project's working directory.
The vulnerability affects the virtio-fs host server, which is responsible for sharing files between the host Mac and the sandboxed virtual machine.
According to Docker, the vulnerable component could follow a symbolic link (symlink) when reopening a previously removed file from a stored path.
An attacker-controlled process running inside the sandbox could replace a parent directory with a symlink pointing somewhere outside the authorized project directory.
This could allow the sandboxed process to access files outside the shared workspace with the privileges of the host account running the virtual machine monitor.
In certain circumstances, this could potentially lead to code execution on the host system.
Second Docker Sandboxes Vulnerability
Docker also fixed another security issue tracked as CVE-2026-79994.
The vulnerability affects the relay responsible for allowing sandboxed applications to communicate with Unix domain sockets within their authorized workspace.
The flaw is caused by a time-of-check-to-time-of-use condition involving symbolic links.
The relay first verified that a socket path was located inside the authorized workspace. However, a malicious process could replace a directory in that path with a symlink between the security check and the actual connection.
This could cause the host to connect to an AF_UNIX socket outside the workspace, potentially exposing sensitive data or host-side capabilities.
Docker rated CVE-2026-79994 High, with a CVSS score of 8.7.
Affected Versions
CVEComponentAffected VersionsPlatformSeverityCVE-2026-77179virtio-fs host server0.28.0 to before 0.42.0macOSCritical, CVSS 9.4CVE-2026-79994Guest-to-host Unix socket relay0.37.0 to before 0.42.0Not specifiedHigh, CVSS 8.7
Both vulnerabilities are fixed in Docker Sandboxes 0.42.0 and later.
As of September 17, 2026, the latest release was 0.43.0, published on September 15.
No Exploitation Reported
Docker has not reported any exploitation of either vulnerability.
CISA's assessment also lists exploitation as none, and neither vulnerability was present in the Known Exploited Vulnerabilities catalog as of the September 16, 2026 release.
The vulnerabilities require malicious code to already be running inside the sandbox.
This could potentially include a compromised AI coding agent or malicious software downloaded and executed by an agent inside the virtual machine.
Docker Sandboxes and AI Coding Agents
Docker Sandboxes are designed to run AI coding agents inside isolated virtual machines.
The project directory is normally shared with the sandbox, allowing the AI agent to read and modify project files.
Docker's security model relies heavily on the virtual machine and hypervisor boundary to isolate the host from code executing inside the sandbox.
The discovered vulnerabilities demonstrate how weaknesses in host-side components responsible for file sharing and communication can potentially undermine that isolation.
Recommended Mitigation
Docker recommends users upgrade to version 0.42.0 or later.
Administrators should:
- Update Docker Sandboxes to 0.42.0 or later.
- Preferably upgrade to the latest available release.
- If an immediate update is not possible, use clone mode.
- Avoid adding additional read-write host mounts while using the workaround.
- Recreate existing sandboxes when switching to clone mode.
Clone mode requires the project to be a Git repository.
In clone mode, the repository is mounted read-only at:
/run/sandbox/source
However, Docker notes that clone mode protects the repository from modifications but does not prevent files from being read inside the sandbox.
Untracked files, including files such as .env, may still be accessible to processes running inside the sandbox.
Important Update Note
Docker published the security advisory and CVE information on September 15, 2026, eight days after version 0.42.0 was released.
The original CVE record for CVE-2026-79994 incorrectly identified version 0.41.0 as the first fixed version. Docker later corrected the record to 0.42.0.
The Docker 0.42.0 release notes did not explicitly identify these CVEs, although they included several sandbox security-related fixes.
Researchers Who Reported the Flaws
Docker credited:
- Oren Yomtov of accomplish.ai for discovering CVE-2026-77179.
- Jurre van Bergen of ThreatNotify for discovering CVE-2026-79994.
The findings highlight the importance of maintaining strong isolation between AI coding agents and host operating systems.
As AI agents increasingly receive permission to execute commands, install software, and modify project files, vulnerabilities in sandbox infrastructure can create a potential path from untrusted code execution inside a sandbox to sensitive resources on the host.
CVE-2026-77179: Critical
CVSS: 9.4
CVE-2026-79994: High
CVSS: 8.7
Fixed Version: Docker Sandboxes 0.42.0 and later
Latest Release as of September 17, 2026: 0.43.0
Exploitation: No exploitation reported
