Docker Sandboxes Flaw CVE-2026-77179 Enables macOS Host Escape

Executive Summary

Docker has disclosed a critical virtual machine escape vulnerability in Docker Sandboxes for macOS, tracked as CVE-2026-77179. The flaw permits untrusted or malicious guest code executing within a sandbox microVM—such as an AI coding agent compromised by prompt injection or malicious dependencies—to escape the guest boundary and read or modify arbitrary files on the macOS host system.

Docker Sandboxes is designed to isolate autonomous AI development workflows, allowing agents to execute system commands, install packages, and manage codebases within dedicated microVMs. Because Docker's isolation architecture relies entirely on the hypervisor boundary rather than in-guest privilege separation, this vulnerability compromises the fundamental isolation model. The flaw affects Docker Sandboxes versions 0.28.0 through 0.41.9 on macOS and has been resolved in version 0.42.0.

Technical Vulnerability Analysis & Attack Chain

The vulnerability stems from flawed path resolution logic within the virtio-fs host server, the high-performance shared file system daemon bridging the macOS host and the guest virtual machine:

Virtio-FS Symlink Traversal Mechanics (CVE-2026-77179)

Under standard operation, Docker Sandboxes mounts the developer's project workspace into the guest virtual machine using virtio-fs:

• Symlink Resolution Vulnerability: When the virtio-fs host daemon reopens a previously removed file from an internal stored path, it improperly follows symbolic links rather than maintaining strict descriptor-based path validation.
• Guest-to-Host Boundary Breakout: Malicious code inside the sandbox creates a directory structure, removes a tracked file, and rapidly substitutes a parent directory with a symlink pointing outside the workspace (e.g. towards the host root filesystem / or the user's home directory ~/).
• Host Context Execution: When the host-side virtio-fs server re-evaluates the file operation, it resolves the symlink on the macOS host. This permits the guest to read and overwrite sensitive files under the privileges of the host Virtual Machine Monitor (VMM) process—effectively the logged-in macOS developer account.

Unix Domain Socket Relay TOCTOU Flaw (CVE-2026-79994)

Alongside CVE-2026-77179, Docker addressed a second high-severity flaw (CVE-2026-79994, CVSS 8.7) affecting versions 0.37.0 through 0.41.9:

• Socket Path Verification Race: Docker Sandboxes includes a relay component that allows sandboxed processes to interact with authorized Unix domain sockets within the project directory. The relay performs a path check to verify that a target socket resides within the designated workspace.
• Time-of-Check to Time-of-Use (TOCTOU): An attacker inside the guest replaces an intermediate directory component with a symlink immediately following the verification check. The host-side relay then connects to the new target, enabling guest code to bind to arbitrary host AF_UNIX sockets (such as the Docker daemon socket or system D-Bus transports), exposing host APIs and enabling arbitrary command execution.

Threat Actor Profile & Campaign Attribution

The vulnerability introduces a severe threat vector against enterprise development organizations adopting autonomous AI coding tools:

• Threat Vector: Prompt-Injected AI Coding Agents: As developers increasingly deploy autonomous AI agents (such as Claude Engineer, Devin, Aider, and OpenHands) to refactor code or run tests, adversaries can weaponize repositories with prompt-injection lures or poisoned dependencies (supply chain attacks via PyPI or npm).
• Target Landscape: Targeted assets include sensitive developer workstations running macOS, where attackers can pivot from guest code execution to harvesting local SSH private keys (~/.ssh), AWS/GCP cloud tokens (~/.aws/credentials), enterprise VPN configurations, and proprietary source repositories.
• Exploitation Status: Docker and cybersecurity authorities report zero confirmed in-the-wild exploitation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Detection & SOC Mitigation Playbook

Security operations and engineering teams must immediately identify vulnerable Docker Desktop and Docker Sandboxes installations across macOS developer fleets:

1. Patch & Workaround Guidance

• Immediate Binary Upgrade: Update Docker Sandboxes to version 0.42.0 or later across all macOS hosts. Verify the running version via command line: sbx --version or docker sandbox version.
• Enforce Git Clone Isolation: Where version upgrades cannot be immediately applied, execute sandboxes exclusively in Clone Mode using the --clone flag (sbx run --clone <repository_url>). Clone mode mounts the repository read-only at /run/sandbox/source, mitigating arbitrary write capabilities to the source directory.
• Recreate Existing Sandboxes: Existing active sandboxes do not automatically adopt updated security policies; terminate and recreate existing environments following the 0.42.0 patch.

2. Network & Perimeter Defenses

• Egress Filtering on Development Subnets: Restrict developer workstation outbound connections to unknown IP ranges and monitor outbound connections originating from virtualization helpers (com.docker.virtualization).
• Audit Unauthorized Socket Exposure: Implement endpoint policies restricting access to the main Docker socket (/var/run/docker.sock) from shared developer workspace directories.

3. Endpoint Detection & Hunting Query

• macOS Endpoint Security (ESF) Symlink Traversal Rule: Deploy detection rules monitoring file creation events where processes childed under com.docker.virtualization or sbx create symlinks resolving to paths containing /Users/, /etc/, or /private/.
• YARA Signature for Malicious Guest virtio-fs Exploit Scaffolding:
  • Rule identifier: Docker_Sandboxes_VirtioFS_Traversal_Artifacts
  • Strings: AF_UNIX, virtio-fs, /run/sandbox/source, openat, symlinkat
• Splunk Hunting Query:
  • index=endpoint process_name="com.docker.virtualization" OR process_name="sbx" event_type=file_modification (file_path="/Users/*/.ssh/*" OR file_path="/Users/*/.aws/*") | stats count by host, user, file_path