CVE-2026-17106: 
Docker vulnerability analysis and mitigation

CVE-2026-17106, dubbed "CopyEscape", is a path traversal and symlink-following vulnerability in the moby/go-archive library that allows a crafted tar archive to create or overwrite files outside the intended extraction directory. It was reported by Ron Masas (@masasron) of Imperva and published on August 18, 2026. Affected products include moby/go-archive < 0.3.0, Docker Engine < 29.7.0, Docker CLI < 29.7.0, Docker Desktop < 4.86.0, Docker Compose < 5.4.0, and Docker Sandboxes < 0.38.0. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution Before File Access / Link Following). The affected extraction routines — Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers — validate destination paths using lexical string checks only, then delegate the actual filesystem operation to the OS, which resolves symbolic links at runtime. An attacker who controls archive contents can embed symlinks pointing outside the destination directory; when the extractor follows these links, subsequent file writes land at arbitrary host paths writable by the extracting process. Public PoC exploits demonstrate exploitation via docker cp (copy-out), using a TOCTOU race condition with inotify monitoring and atomic symlink pivoting to time the link swap between the path check and the write (GitHub Advisory, Imperva Blog).

An attacker who controls the contents of a tar archive (or a container from which files are copied via docker cp) can create or overwrite arbitrary files at any path writable by the extracting process. On Linux systems where Docker runs as root, this enables overwriting critical host binaries such as /usr/bin/runc, leading to full host compromise and container escape. The impact spans confidentiality (reading sensitive host files), integrity (overwriting system binaries or configuration), and availability (corrupting or replacing critical executables), with high potential for lateral movement from a container to the underlying host (GitHub Advisory, Imperva Blog).

Multiple high-confidence, fully functional proof-of-concept exploits are publicly available on GitHub. The masasron/CopyEscape-CVE-2026-17106 repository contains shell scripts for both macOS and Linux demonstrating the attack, including overwriting /usr/bin/runc with attacker-controlled code executed as root. A second PoC at 686f6c61/POC-CopyEscape-CVE-2026-17106 implements a complete attack chain using an LD_PRELOAD library to mask directories, inotify for race condition timing, and atomic rename operations to pivot symlinks. As of the advisory date, no confirmed in-the-wild exploitation has been reported. The EPSS score is approximately 0.193%, and the vulnerability is not currently listed in the CISA KEV catalog. NVD SSVC classifies exploitation status as "PoC" (Feedly).

1. Prepare a malicious container or archive: Create a Docker container or tar archive containing a symlink that points to a target path outside the intended extraction directory (e.g., a symlink link -> /usr/bin inside the archive).
2. Stage the race condition (TOCTOU): Use an inotify watcher on the destination directory to detect when the extractor begins processing the archive entry, enabling precise timing of the symlink pivot.
3. Pivot the symlink atomically: At the moment the extractor has passed its lexical path check but before the OS resolves the path for the write, atomically rename/replace the symlink to point to the target host path (e.g., /usr/bin/runc) using an LD_PRELOAD library to mask directory contents from the extractor.
4. Trigger docker cp (copy-out): Execute docker cp <container>:<path> <host_destination> to invoke the vulnerable moby/go-archive extraction routines, which follow the pivoted symlink and write attacker-controlled content to the host path.
5. Achieve code execution: The overwritten host binary (e.g., /usr/bin/runc) now contains attacker-controlled code. The next time Docker spawns a container using runc, the attacker's code executes as root on the host, completing the container escape (Imperva Blog, Feedly).

• Process: Unexpected child processes spawned by the Docker daemon or runc (e.g., reverse shells, curl, wget, bash -i); runc or Docker daemon processes exhibiting unusual behavior or unexpected network connections.
• File System: Unexpected modification timestamps on host binaries such as /usr/bin/runc, /usr/bin/docker, or other system executables; new or modified files in /etc/, /usr/bin/, or other system directories with ownership matching the Docker daemon's UID; presence of LD_PRELOAD libraries in unusual locations.
• Logs: Docker daemon logs (/var/log/docker.log or journalctl -u docker) showing docker cp operations from containers to host paths outside expected directories; audit logs (auditd) recording writes to system binary paths by the Docker daemon process.
• Network: Outbound connections from the Docker host to unknown external IPs originating from the dockerd or runc process; unexpected listening ports opened by processes running as root.
• Artifacts: Presence of PoC-related files such as entrypoint.sh, run-poc.sh, monitor.c, or watched_preload.so in container filesystems or host temp directories (Feedly, Imperva Blog).

Upgrade to the following patched versions immediately: moby/go-archive ≥ 0.3.0, Docker Engine ≥ 29.7.0, Docker CLI ≥ 29.7.0, Docker Desktop ≥ 4.86.0, Docker Compose ≥ 5.4.0, and Docker Sandboxes ≥ 0.38.0 (go-archive v0.3.0, Docker CLI v29.7.0, Docker Compose v5.4.0, Docker Sandboxes v0.38.0). As a workaround until patching is possible, only extract archives from fully trusted sources, restrict use of docker cp to trusted containers, and implement strict file permissions to limit paths writable by the Docker daemon. Running Docker with user namespaces enabled can reduce the blast radius by preventing the daemon from writing to root-owned system paths (GitHub Advisory).

The vulnerability was discovered and reported by Ron Masas of Imperva, who published a detailed technical blog post titled "CopyEscape: Taking Over Docker Hosts with docker cp" (Imperva Blog). The disclosure generated significant community attention, with coverage from CyberSecurityNews, GBHackers, The Hacker News weekly recap, and multiple security-focused Mastodon and Reddit threads. The NHS Digital cyber alerts team (CC-4828) and AUSCERT also issued advisories. SUSE released a security update (SUSE-SU-2026:3863-1) addressing the issue in Apptainer, indicating broad ecosystem impact beyond Docker itself. Community sentiment on Reddit's r/cybersecurity highlighted concern about the container-to-host escape potential and the availability of working PoC exploits (Feedly).