This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Docker fixes a critical and a high-severity vulnerability in Docker Sandboxes
Docker fixes a critical and a high-severity vulnerability in Docker Sandboxes with version 0.42.0 [1].
An unauthenticated local attacker can, provided that Docker Sandbox runs on macOS, due to a flaw in symlink following by the virtio-fs server, escape the shared space and read or modify arbitrary host files as the VMM user or potentially execute code on the host system [1][2].
The vulnerability is present in product:
- macOS:Docker Sandboxes; >=0.28.0, <=0.42.0;
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
More information:
- CVE-2026-77179 at cve.org, NVD
- CWE-59: Improper Link Resolution Before File Access ('Link Following') at cwe.mitre.org
The vulnerability was publicly disclosed 15. 9. 2026.
An unauthenticated local attacker can exploit a TOCTOU vulnerability in the forwarding of Unix domain sockets from the guest to the host and, between the check and the connection, replace an intermediate directory with a symlink, thereby making the host connect to an arbitrary AF_UNIX socket outside the shared space and thus gain unauthorized access to data or host privileges provided by that socket [1][3].
The vulnerability is present in product:
- Docker Sandboxes; >=0.37.0, <=0.42.0;
CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
More information:
- CVE-2026-79994 at cve.org, NVD
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition at cwe.mitre.org
The vulnerability was publicly disclosed 15. 9. 2026.
Links
By CESNET, z.s.p.o. Táňa Macháčková on 16. 9. 2026.