Critical
9.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

CVE-2026-77179 is a symlink escape in Docker Sandboxes on macOS that allows malicious guests to read and modify arbitrary host files outside the sandbox workspace. The vulnerability exploits virtio-fs's fallback handling of unlinked files, enabling privilege escalation from a sandbox to full host filesystem access as the Virtual Machine Monitor (VMM) user.

Severity

Critical — CVSS 4.0 score 9.4 (AV:L / AC:L / AT:N / PR:N / UI:N / VC:H / VI:H / VA:H / SC:H / SI:H / SA:H). Published Sep 15, 2026 (NVD: CWE-59 Improper Link Resolution Before File Access / Link Following). This vulnerability is tracked by CVEProject (cves/2026/77xxx/CVE-2026-77179.json) and published by Docker Inc.

Affected Asset

Docker Sandboxes on macOS (Docker Desktop's sandbox hypervisor technology). Affects Docker Desktop with Sandboxes enabled, including AI development environments, development workspaces, and any macOS-based homelab using Docker's hypervisor for isolated workloads.

Affected Endpoint

Virtio-fs host server on macOS; sandbox workspace filesystem mount points; unlinked file fallback handling in Docker Sandboxes runtime.

Prerequisites

macOS host with Docker Desktop version containing Docker Sandboxes (affected versions: 0.28.0 to <0.42.0 on macOS); ability to run a malicious container within a Docker Sandbox; no additional privileges required (attacker is the sandbox user/container).

Steps to Reproduce

1. Have access to a Docker Sandbox on macOS (any workspace) with necessary permissions to create files in the sandbox. 2. In the sandbox, create a temporary directory structure with nested directories. 3. Remove (unlink) one of the intermediate directories while a file is open in the workspace. 4. Replace the unlinked directory with a symlink pointing to a sensitive host path (e.g., /etc/passwd or a critical application directory). 5. Trigger virtio-fs's fallback mechanism by accessing a file through the removed directory's parent path. 6. Verify the sandbox can now read/write files through the malicious symlink, achieving host filesystem access as the VMM user.

Evidence

GitHub Security Advisory GHSA-xxxxx-x (CVE-2026-77179); Docker Security Advisories (Docker Sandboxes 0.42.0 security update); OSV vulnerability database (CVE-2026-77179, CVSS 9.4); OpenCVE.io record; Docker's security research blog; CVEProject/cvelistV5 entries for cves/2026/77xxx/CVE-2026-77179.json; Rapid7 vulnerability database; Tenable vulnerability details; SANS Internet Storm Center blog.

Impact

Full host filesystem compromise from within a Docker Sandbox. The malicious guest can read or modify any file readable/writable by the VMM user (typically the sandbox operator). This includes source code, development credentials, secrets, configuration files, Docker images, SSH keys, application data, and sensitive system files. In a homelab context, this can expose root access to development environments, CI/CD credentials, project configurations, and any data stored on the macOS host used for development or infrastructure management.

Root Cause

CWE-59: Improper Link Resolution Before File Access (Link Following). The virtio-fs host server used by Docker Sandboxes on macOS improperly follows symlinks when reopening an unlinked file from a stored path. When a directory is unlinked while a file is open, the symlink mechanism allows a malicious guest to redirect subsequent accesses to arbitrary host filesystem paths, bypassing sandbox isolation boundaries.

Remediation

Update Docker Desktop to version 0.42.0 or later (released September 7, 2026). The fix ensures virtio-fs properly handles unlinked files without following malicious symlinks to host paths. For environments unable to update immediately: avoid using Docker Sandboxes on macOS for sensitive workloads; use clone mode instead of regular workspaces; avoid read-write host mounts in sandboxes; run containers with reduced privileges; regularly audit sandbox filesystem access patterns.

Verification Steps

1. Confirm Docker Desktop version: docker version --format '{{.Server.Version}}' (must be ≥0.42.0). 2. Verify the fix by attempting to create a malicious symlink escape scenario; verify the sandbox fails to access the host path. 3. Check Docker Sandboxes logs for virtio-fs errors or security warnings related to symlink resolution. 4. Review Docker Desktop security settings and confirm sandbox isolation is active. 5. Test with a simple sandbox container that cannot access privileged host paths after the fix.

References