Search CVEs, research… / diras.sa
  • PoC PUBLIC
  • PATCH AVAILABLE

CVE-2026-77179: host escape and code execution in Docker Docker Sandboxes

A guest VM with control over files in a Docker Sandboxes environment can manipulate shared paths to break out to the macOS host and access or alter host files, possibly executing code there. CVE-2026-77179 impacts Docker Sandboxes versions 0.28.0 through before 0.42.0 and is resolved in 0.42.0. Exploitation relies on the attacker running code inside the sandboxed guest and taking advantage of how the macOS virtio-fs host component reopens stored paths that reference removed files.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 4.0
9.4CRITICAL
EPSS
0.00199
CWE
CWE-59
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Treat this as urgent: public exploit code is available, so upgrade to the fixed Docker Sandboxes release 0.42.0 immediately or block use of affected sandbox instances until patched.

What is CVE-2026-77179?

A guest VM with control over files in a Docker Sandboxes environment can manipulate shared paths to break out to the macOS host and access or alter host files, possibly executing code there. CVE-2026-77179 impacts Docker Sandboxes versions 0.28.0 through before 0.42.0 and is resolved in 0.42.0. Exploitation relies on the attacker running code inside the sandboxed guest and taking advantage of how the macOS virtio-fs host component reopens stored paths that reference removed files. The weakness is classified as CWE-59 (Link Following).

Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Which versions of Docker Docker Sandboxes are affected?

BRANCHAFFECTEDFIXED
0.x0.28.0 – before 0.42.00.42.0

Is CVE-2026-77179 being exploited?

Public exploit code is available.

How to fix CVE-2026-77179

  1. Upgrade Docker Sandboxes to 0.42.0 (the release that fixes CVE-2026-77179).
  2. If you cannot upgrade immediately, stop or block affected Sandboxes on macOS until you can patch.
  3. Limit who can run or provision guest images and restrict guest code execution to trusted users to reduce risk.
  4. Monitor the host for unexpected file changes and review logs for signs of guest-driven filesystem activity; follow vendor guidance for additional mitigations.

Frequently asked questions

Is CVE-2026-77179 being actively exploited?

Public exploit code is available for CVE-2026-77179.

Which Docker Sandboxes versions are affected by CVE-2026-77179?

Docker Sandboxes versions 0.28.0 through before 0.42.0 are affected; the issue is fixed in 0.42.0.

Is there a patch for CVE-2026-77179?

Yes. The vulnerability is fixed in Docker Sandboxes version 0.42.0; upgrade to that release.

What can an attacker do with CVE-2026-77179?

A malicious guest can replace a parent directory with a symlink to escape the shared workspace and read or modify host files as the VMM user, which can lead to host code execution on macOS.

References