Docker has fixed two serious vulnerabilities in Docker Sandboxes that could allow a malicious workload inside a sandbox to cross the intended shared-workspace boundary and interact with host-side resources.
The flaws, tracked as CVE-2026-77179 and CVE-2026-79994, were addressed in Docker Sandboxes 0.42.0, released on September 7, 2026.
Docker Sandboxes are designed to run AI coding agents and other potentially untrusted workloads inside isolated microVMs. Each sandbox receives its own Linux kernel, Docker Engine, filesystem, and network, while host access is limited to resources explicitly shared with the sandbox.
That trust model makes filesystem and socket boundaries especially important. Both of the newly fixed vulnerabilities involved unsafe handling of paths that could allow a guest-controlled workload to reach resources outside its authorized workspace.
CVE-2026-77179: Critical macOS Workspace Escape #
CVE-2026-77179 is rated Critical and affects Docker Sandboxes versions 0.28.0 through versions earlier than 0.42.0 on macOS.
According to Docker’s security advisory, the issue existed in the virtio-fs host server, which is responsible for making selected host files available inside the sandbox.
The vulnerable implementation could follow symbolic links when reopening an unlinked file from a previously stored path. A malicious guest could manipulate the filesystem after the original path had been recorded by replacing a parent directory with a symlink.
That change could redirect a later host-side file operation outside the authorized workspace.
Docker says successful exploitation could allow a malicious guest to read or modify arbitrary host files accessible to the virtual machine monitor user. Because modifying sensitive host files may create a path to code execution, the impact could potentially extend to compromise of the underlying host.
This is more precise than describing the bug simply as a traditional virtual-machine escape. The vulnerability primarily breaks the filesystem boundary that Docker Sandboxes relies on to restrict what the guest can access on the host.
CVE-2026-79994: Unix Socket Relay TOCTOU Flaw #
The second vulnerability, CVE-2026-79994, is rated High and affects Docker Sandboxes versions 0.37.0 through versions earlier than 0.42.0.
This flaw affects the guest-to-host Unix domain socket relay. Docker Sandboxes can allow workloads to communicate with specifically authorized host-side Unix sockets when that access is intentionally configured.
The relay validated that a requested socket path was located inside an authorized workspace. However, it later connected using the pathname again rather than a securely retained reference.
That created a classic time-of-check to time-of-use, or TOCTOU, race condition.
A malicious guest could replace an intermediate directory with a symbolic link after the path check but before the host performed the connection. As a result, the host could be redirected to an arbitrary AF_UNIX socket outside the approved workspace.
The practical impact depends on which local socket is reached. Docker notes that exploitation could expose data or host-side capabilities provided by the targeted service.
Why These Docker Sandbox Vulnerabilities Matter for AI Workloads #
Docker Sandboxes are particularly relevant to AI-agent security because modern coding agents frequently need broad capabilities inside their execution environment.
Docker’s security model intentionally gives an agent significant control inside its microVM, including package installation, sudo access, its own Docker Engine, and read-write access to configured workspace files. The microVM boundary is therefore responsible for preventing those powerful capabilities from extending to the host.
That model is useful when running unfamiliar repositories, autonomous coding tools, or workloads that should not be trusted with direct host access.
However, the two newly patched flaws show why the controls surrounding shared files and host integrations are just as important as the VM itself.
This is also part of a wider security challenge around increasingly autonomous tooling. Google recently documented an autonomous AI-agent credential-harvesting campaign completed in under six hours, highlighting how quickly automated systems can act once they obtain access to useful infrastructure or credentials.
Direct Mounts Create a Larger Host Trust Surface #
Docker supports several ways to provide a workspace to a sandbox.
With a normal direct mount, the sandbox receives read-write access to the shared host working directory. Changes made by the agent appear on the host immediately.
Docker’s documentation warns that these files should be treated similarly to code received from an untrusted contributor. Build scripts, Git hooks, CI configuration, IDE tasks, package scripts, and AI configuration files can all become execution paths after a sandbox session.
Clone mode provides a stronger boundary for Git-based workflows. In this mode, the host repository is exposed read-only while the agent works on a private clone inside the sandbox. The agent’s changes do not reach the host working tree until the developer explicitly fetches or integrates them.
Docker also supports mountless sandboxes, where no host workspace is shared at all.
What Administrators Should Do #
Organizations using Docker Sandboxes should upgrade to version 0.42.0 or later.
Docker currently lists newer releases as well, so administrators should normally deploy the latest supported stable version rather than stopping at the minimum patched build.
If an immediate upgrade is not possible, Docker recommends two important mitigations:
- Use clone mode when working with Git repositories.
- Avoid read-write host mounts until the vulnerable version can be upgraded.
Teams running autonomous coding agents should also review what resources are intentionally shared with each sandbox. That includes host workspaces, Unix sockets, MCP integrations, network destinations, credentials, and shared agent skills.
Secrets Still Need Separate Protection #
Sandbox isolation does not remove the need for proper credential management.
Docker’s architecture keeps supported API credentials outside the guest and injects authentication through a host-side proxy, but developers may still accidentally place secrets inside a mounted project directory.
For example, an untracked .env file inside a repository can still be readable from a clone-mode source mount even though the repository itself is read-only.
The same principle applies outside Docker. Long-lived credentials stored in repositories, CI configuration, state files, or developer workstations can become high-value targets once an attacker obtains filesystem access. We previously covered how exposed AWS keys can create serious cloud access risks.
Docker Has Patched Other Escape Issues in 2026 #
The Docker Sandboxes fixes follow another Docker security update issued earlier in 2026.
Docker Desktop 4.86.0 fixed CVE-2026-17106, a destination-escape flaw in docker container cp. Although that vulnerability affects a different Docker component, it reinforces the importance of carefully validating destination paths whenever host and isolated environments exchange files.
Bottom Line #
CVE-2026-77179 and CVE-2026-79994 show that sandbox security depends on more than simply placing a workload inside a microVM.
The surrounding host integration layer — file sharing, Unix sockets, credentials, networks, and developer workflows — is part of the effective security boundary as well.
For Docker Sandboxes users, the priority is straightforward: upgrade to a patched release, minimize writable host exposure, prefer clone or mountless workflows for untrusted workloads, and review every host resource that an autonomous agent is allowed to reach.