CVE-2026-17106: 
Docker Analyse et atténuation des vulnérabilités

CVE-2026-17106 (dubbed "CopyEscape") is a container-to-host arbitrary file-write vulnerability in Docker's docker cp command and the sbx cp command in Docker Sandboxes. Discovered by Imperva's Red Team and reported to Docker on April 11, 2026, it was publicly disclosed on August 10, 2026. Affected versions include Docker Engine up to 29.7.1, Docker Desktop up to 4.85.x, and Docker Sandboxes prior to 0.38.0. The vulnerability is rated HIGH/Critical severity (Imperva).

The vulnerability chains two weaknesses in Docker's archive pipeline, rooted in a time-of-check/time-of-use (TOCTOU) race condition (CWE-367) and an improper path containment check during archive extraction. First, the Docker daemon uses filepath.WalkDir to traverse the container's live filesystem and build a tar archive; because the container's processes are not frozen during this walk, an attacker-controlled process can race to replace a directory entry with a symlink between the traversal decision and the Lstat call in addTarFile, producing an inconsistent tar stream where one entry is recorded as a symlink and its child as a directory descendant. Second, the Docker CLI's extractor in moby/go-archive validates a path constructed with filepath.Join but passes the original hdr.Linkname from the archive to os.Symlink, meaning the containment check approves one path while the kernel follows another — an absolute symlink pointing outside the intended destination. When the child entry is subsequently extracted, the CLI does not re-verify confinement against the resolved symlink target, allowing the attacker's bytes to land at an arbitrary host path. The vulnerability was present in github.com/moby/go-archive v0.2.0 and was validated on Docker Engine 29.6.1 (Linux) and Docker Desktop 4.81.0 (macOS) (Imperva).

Successful exploitation grants an attacker-controlled container an arbitrary file create or overwrite primitive on the host machine, scoped to the permissions of the user or process invoking docker cp. On macOS with Docker Desktop, a malicious container can overwrite shell startup scripts, user-level executables, SSH configuration, source trees, cloud credentials, or persistence mechanisms under ~/Library/LaunchAgents, enabling code execution the next time the user opens a terminal. On Linux, if docker cp is invoked with sudo or by a root-running CI/automation process, the attacker can overwrite system executables such as /usr/bin/runc, converting the file write into root code execution on the next Docker lifecycle operation. The vulnerability is particularly impactful in CI/CD pipelines, developer workstations, incident-response workflows (where copying evidence from a suspected container triggers the payload), and AI-agent workflows using Docker Sandboxes' sbx cp (Imperva).

A proof-of-concept exploit was developed and validated by Imperva's Red Team, with video demonstrations published for both Linux (root code execution via runc replacement) and macOS (developer compromise via shell startup file overwrite). Exploitation requires a user or automated system to invoke docker cp against an attacker-controlled container path — no additional privileges inside the container are needed. The race condition is made reliable (not blind) by using an LD_PRELOAD interposer to control what the daemon sees, a large file to widen the timing window, and filesystem notifications to signal the precise moment to perform the two renames. No EPSS score or CISA KEV catalog listing was available at time of reporting; no third-party threat actor attribution has been published (Imperva).

1. Prepare the malicious container: Build a container image containing a crafted filesystem under a watched path (e.g., /watched/file.txt). Use an LD_PRELOAD interposer to make file.txt appear as a regular file to processes inside the container, while the Docker daemon sees it as a directory containing an attacker-controlled tree.
2. Stage the pivot: Place a large file immediately before the pivot directory to widen the timing window. Set up filesystem notifications (e.g., inotify) to detect when the Docker daemon's WalkDir opens that large file, signaling that the walk has reached the target location.
3. Trigger the race: When the notification fires, perform two rapid rename operations: move the directory aside and replace it with a staged absolute symlink (e.g., escape -> /usr/bin). This causes WalkDir to have recorded escape as a directory while addTarFile now sees and emits it as a symlink.
4. Produce the inconsistent tar archive: WalkDir descends through escape using its stale directory type and emits a child entry (e.g., file.txt/escape/runc) into the tar stream. The archive now contains a symlink header for escape followed by a child entry as if escape were still a directory.
5. Exploit the extractor's containment bypass: When the victim runs docker cp container:/watched/file.txt ./output, the Docker CLI extracts the archive. The containment check validates a filepath.Join-constructed path but passes the original absolute hdr.Linkname (/usr/bin) to os.Symlink. The check approves one path; the kernel follows another.
6. Write to the host: The CLI extracts the child entry (runc) through the now-planted symlink, writing attacker-controlled bytes to /usr/bin/runc (or another target) on the host with the permissions of the docker cp process.
7. Achieve code execution: On the next Docker lifecycle operation that invokes runc, the replaced binary executes attacker-controlled code. On macOS, overwriting a shell startup script achieves code execution the next time the user opens a terminal (Imperva).

• File System: Unexpected modification timestamps on system executables such as /usr/bin/runc or shell startup files (e.g., ~/.bashrc, ~/.zshrc, ~/Library/LaunchAgents/*.plist); new or modified files in paths that should not be writable by the Docker CLI user; presence of LD_PRELOAD-related shared objects inside container images.
• Process: Unusual child processes spawned by runc or Docker lifecycle operations (e.g., /bin/bash, curl, wget) that do not correspond to expected container workloads; unexpected processes executing immediately after a docker cp command completes.
• Logs: Docker daemon logs showing docker cp operations against running containers, especially from CI/CD pipelines or automated scripts; audit logs (auditd) recording writes to sensitive paths (/usr/bin/, /etc/, ~/.ssh/) by the Docker CLI process (dockerd, docker).
• Network: Outbound connections from the host to unexpected external IPs originating from processes that replaced system binaries (e.g., a modified runc establishing a reverse shell) (Imperva).

Users should upgrade to Docker Engine/CLI 29.7.2 or later and Docker Desktop 4.86.0 or later, which bundle the patched moby/go-archive v0.3.0 with hardened extraction logic. Docker Sandboxes 0.38.0 (released August 6, 2026) addresses the sbx cp destination-escape flaw. Where immediate upgrading is not possible: stop the container before running docker cp (a stopped container cannot perform the producer race); avoid sudo docker cp and root-run copy automation; run the Docker CLI with least privilege; and retrieve data from suspicious containers using a disposable account, VM, or isolated environment. Note that stopping the container blocks the demonstrated race but does not make archive extraction from untrusted sources inherently safe — any archive from an untrusted source should still be treated as hostile input (Imperva).

Imperva's Red Team published a detailed technical write-up on August 10, 2026, praising Docker's security and engineering teams for investigating the report and coordinating the CVE, while noting that the initial fix introduced significant functional regressions requiring follow-up releases. The disclosure was shared on social media by security researchers including a post noted by Dinosn on August 10, 2026. The vulnerability received coverage from IT security news aggregators. The responsible disclosure process spanned approximately four months (April 11 to August 10, 2026), with multiple deadline extensions to accommodate regression fixes (Imperva).