CVE-2026-17106: 
Docker Análisis y mitigación de vulnerabilidades

CVE-2026-17106, dubbed "CopyEscape", is a path traversal and symlink-following vulnerability in the moby/go-archive library's tar extraction routines (Unpack, UnpackLayer, Untar/UntarUncompressed, and ApplyLayer helpers). An attacker who controls the contents of a tar archive can create or overwrite files at arbitrary paths writable by the extracting process, enabling container-to-host escape via docker cp. Affected products include moby/go-archive < 0.3.0, Docker Engine < 29.7.0, Docker CLI < 29.7.0, Docker Desktop < 4.86.0, Docker Compose < 5.4.0, and Docker Sandboxes < 0.38.0. The vulnerability was published on August 18, 2026, with a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, go-archive v0.3.0).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution Before File Access / Link Following). The extractor validates destination paths using lexical string checks before performing filesystem operations, but the actual OS path resolution occurs afterward — allowing symlinks embedded in the archive to redirect writes outside the intended destination directory. This TOCTOU-style flaw means an attacker can craft a tar archive containing a symlink pointing to a host path (e.g., /usr/bin/runc), then place a malicious file entry that follows that symlink during extraction. The attack is exploitable locally with no privileges required, but requires active user interaction (e.g., a user or process running docker cp to copy files from a malicious container) (GitHub Advisory). Public PoC exploits use LD_PRELOAD libraries to mask directories, inotify monitoring for race condition timing, and atomic rename operations to pivot symlinks at the critical moment (Feedly).

Successful exploitation allows an attacker controlling a container to overwrite arbitrary files on the Docker host that are writable by the extracting process — which typically runs as root. The most severe demonstrated impact is overwriting host binaries such as /usr/bin/runc with attacker-controlled code, achieving root code execution on the host and effectively breaking container isolation. This results in full confidentiality, integrity, and availability compromise of the vulnerable system, and enables lateral movement from a compromised container to the underlying host infrastructure (GitHub Advisory, Imperva Blog).

Multiple high-confidence, fully functional proof-of-concept exploits are publicly available on GitHub. The CopyEscape PoC by masasron includes runnable shell scripts and Docker demonstrations that achieve arbitrary file writes on real Docker hosts, while a second PoC implements a complete attack chain using LD_PRELOAD, inotify, and atomic renames to exploit a TOCTOU race condition. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.193%, and NVD SSVC classifies exploitation status as "PoC" (Feedly).

1. Prepare a malicious container: Create or control a Docker container that contains a crafted tar archive. The archive includes a symlink entry pointing to a sensitive host path (e.g., link -> /usr/bin/runc) and a regular file entry that will be written through that symlink.
2. Set up race condition tooling (TOCTOU variant): Compile and load a LD_PRELOAD shared library (watched_preload.c) that intercepts filesystem calls and masks directory entries. Set up an inotify monitor (monitor.c) to detect when docker cp begins processing the archive.
3. Trigger docker cp: Execute docker cp <container>:<path> <host_destination> to initiate extraction of the malicious archive from the container to the host. The extracting process (running as root) resolves paths via the OS after only lexical validation.
4. Pivot the symlink: At the precise moment detected by the inotify monitor, perform an atomic rename() to swap the symlink target from a benign path to the intended host target (e.g., /usr/bin/runc), exploiting the TOCTOU window.
5. Achieve arbitrary file write: The extractor follows the now-redirected symlink and writes the attacker-controlled file content to the host path outside the intended destination directory.
6. Execute as root: The overwritten binary (e.g., runc) is subsequently invoked by Docker during normal container operations, executing the attacker's payload with root privileges on the host (Feedly, Imperva Blog).

• Process: Unexpected child processes spawned by dockerd or docker cp (e.g., /bin/bash, curl, wget); runc or other Docker binaries behaving unexpectedly or with modified timestamps.
• File System: Modification timestamps on host binaries such as /usr/bin/runc, /usr/bin/docker, or other system executables changed unexpectedly; new or modified files in host system directories (/usr/bin/, /etc/, /usr/lib/) with ownership matching the Docker daemon user; presence of LD_PRELOAD libraries in unusual locations.
• Logs: Docker daemon logs (/var/log/docker.log or journalctl -u docker) showing docker cp operations from containers to host paths outside expected directories; audit logs (auditd) recording writes to system binary paths by the Docker daemon process.
• Network: Unexpected outbound connections from the Docker host to unknown IPs following a docker cp operation, potentially indicating a reverse shell established via an overwritten binary.
• File Integrity: Hash mismatches on monitored host binaries (e.g., via AIDE, Tripwire, or similar FIM tools) for files such as /usr/bin/runc (Imperva Blog, GitHub Advisory).

Upgrade to the patched versions immediately: moby/go-archive ≥ 0.3.0, Docker Engine ≥ 29.7.0, Docker CLI ≥ 29.7.0, Docker Desktop ≥ 4.86.0, Docker Compose ≥ 5.4.0, and Docker Sandboxes ≥ 0.38.0 (go-archive v0.3.0, Docker CLI v29.7.0, Docker Compose v5.4.0, Docker Sandboxes v0.38.0). As a workaround until patching is possible, only use docker cp with trusted containers and avoid copying files from untrusted or externally-sourced container images. Implement file integrity monitoring (FIM) on critical host binaries and restrict which users can execute docker cp via Docker access controls (GitHub Advisory).

The vulnerability was discovered and reported by Ron Masas (@masasron) of Imperva, who published a detailed technical blog post titled "CopyEscape: Taking Over Docker Hosts with docker cp" (Imperva Blog). The disclosure generated significant community attention on Reddit's r/cybersecurity and security-focused Mastodon/Infosec.exchange accounts, with multiple security news outlets including CyberSecurityNews, GBHackers, and SecurityOnline covering the story. The NHS Digital Cyber Alerts team (CC-4828) and TLDR InfoSec newsletter also highlighted the vulnerability, reflecting broad industry awareness. The availability of working PoC exploits shortly after disclosure amplified urgency in the security community.