Docker Sandboxes CVE-2026-77179 and CVE-2026-79994: Upgrade to 0.42.0 or Later
Docker has fixed two vulnerabilities in Docker Sandboxes that can let malicious code running inside an AI-agent sandbox cross its authorized workspace boundary and reach host resources. Docker Sandboxes 0.42.0, released September 7, 2026, is the first version that fixes both CVE-2026-77179 and CVE-2026-79994.
The more severe issue, CVE-2026-77179, is rated Critical by Docker. It affects Docker Sandboxes 0.28.0 up to, but excluding, 0.42.0 on macOS. A malicious guest can exploit symlink handling in the virtio-fs host server to escape the shared workspace and read or modify arbitrary host files with the privileges of the VMM user, potentially reaching host code execution.
The second issue, CVE-2026-79994, affects versions 0.37.0 up to, but excluding, 0.42.0. Docker rates it High. A race in the guest-to-host Unix-domain socket relay can redirect a validated workspace socket path to an arbitrary AF_UNIX socket outside the workspace, exposing data or host-side capabilities provided by that socket.
Affected versions and fixes
| Vulnerability | Component | Affected versions | Impact | First fixed version |
|---|---|---|---|---|
| CVE-2026-77179 | virtio-fs host server | 0.28.0 to <0.42.0 on macOS | Workspace escape; arbitrary host-file read/write as the VMM user; potential host code execution | 0.42.0 |
| CVE-2026-79994 | Guest-to-host Unix socket relay | 0.37.0 to <0.42.0 | Connection to an arbitrary host AF_UNIX socket outside the authorized workspace |
0.42.0 |
Docker's security announcement identifies 0.42.0 as the remediation boundary for both vulnerabilities. Operators already running 0.42.0 or a later release have the relevant fixes.
Why CVE-2026-77179 matters for AI coding agents
Docker Sandboxes runs coding agents and other potentially untrusted workloads inside lightweight microVMs. A workspace is the intended host-file boundary: an agent can be given access to a project directory without receiving general access to the developer's host filesystem.
CVE-2026-77179 breaks that boundary on affected macOS installations. The virtio-fs host server can follow a symlink when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink before the reopen operation, directing the host-side server outside the shared workspace.
The resulting access runs with the rights of the VMM user. On a developer workstation, files reachable by that account can include source trees, configuration files and locally stored development credentials. The exact exposure depends on the host account and its filesystem permissions.
CVE-2026-79994 targets the socket relay
Docker Sandboxes also provides a relay for authorized Unix-domain sockets. CVE-2026-79994 is a time-of-check/time-of-use race in that path.
The relay first verifies that a requested socket path belongs to the authorized workspace. It later reconnects using the pathname. During that interval, a malicious guest can replace an intermediate directory with a symlink and redirect the host connection to another AF_UNIX socket.
The security consequence depends on the targeted socket. Host-side services exposed through Unix sockets can provide sensitive data or privileged capabilities, making the workspace boundary important even when the guest cannot directly access the corresponding host path.
What administrators and developers should do
Upgrade Docker Sandboxes to 0.42.0 or later. Check the installed version before continuing to run untrusted repositories, autonomous coding agents or workflows that process attacker-controlled content.
Docker provides a temporary exposure-reduction measure when an immediate update is unavailable: use clone mode and avoid additional read-write host mounts. Clone mode reduces the guest's ability to manipulate the host-side directory structure involved in these flaws.
Treat that measure as interim containment. Updating removes the vulnerable implementations and is the appropriate remediation.
Teams that used affected Sandboxes with untrusted workloads should review what the host account could access during those runs. Investigation priority is highest where agents processed untrusted repositories, dependencies, prompts or other attacker-influenced inputs while host directories were shared read-write.
Exploitation status
Docker's public security material establishes the vulnerability mechanics and fixed versions. Current public evidence reviewed by AiCybr does not establish in-the-wild exploitation of either CVE. The remediation priority comes from the host-boundary impact and the role of Sandboxes in executing potentially untrusted agent workloads.
Bottom line
Docker Sandboxes users should standardize on 0.42.0 or later. CVE-2026-77179 is especially consequential on macOS because malicious guest code can cross the workspace filesystem boundary and operate on host files as the VMM user. CVE-2026-79994 provides a separate route to host-side Unix sockets.
The practical control is straightforward: upgrade, and use clone mode without extra read-write host mounts only as a temporary measure when patching cannot happen immediately.