CVE-2026-79994: 
Docker vulnerability analysis and mitigation

CVE-2026-79994 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Docker Sandboxes that allows a malicious guest to redirect the host into connecting to arbitrary Unix-domain sockets outside the authorized workspace. The flaw affects Docker Sandboxes versions 0.37.0 through 0.41.x (fixed in 0.42.0). It was published on September 15, 2026, with a patch released the same day. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is a TOCTOU race condition (CWE-367) in the guest-to-host Unix-domain socket relay component of Docker Sandboxes. The relay validates that a requested socket path resides within an authorized workspace directory, but then reconnects to the socket using the original pathname rather than a resolved, validated reference. Between the validation and the connection, a malicious guest can replace an intermediate directory in the path with a symbolic link pointing outside the workspace, causing the host to connect to an arbitrary AF_UNIX socket of the attacker's choosing. This is a local attack requiring the attacker to have code execution inside a Docker Sandbox (Attack Requirements: Present), but no elevated privileges within the guest are needed (GitHub Advisory, Docker sbx-releases v0.42.0).

Successful exploitation allows a malicious guest process to cause the Docker Sandbox host daemon to connect to arbitrary AF_UNIX sockets outside the shared workspace, bypassing the intended isolation boundary. This can expose sensitive data accessible via those host sockets and grant the attacker access to host-side capabilities — such as D-Bus, Docker daemon sockets, or other privileged services — that the targeted socket provides. Both confidentiality and integrity of the host system and subsequent systems are rated High, with potential for significant privilege escalation or lateral movement depending on which host socket is targeted (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable. The EPSS score is approximately 0.106% (1st percentile), reflecting a low near-term exploitation probability. Exploitation requires an attacker to already have code execution inside a Docker Sandbox, limiting the attack surface to compromised or malicious sandbox workloads.

1. Gain guest execution: Obtain code execution inside a Docker Sandbox instance (e.g., via a malicious workload, compromised dependency, or social engineering a user to run attacker-controlled code in a sandbox).
2. Identify a target socket path: Enumerate socket paths within the authorized workspace that the guest-to-host relay will accept, and identify a valuable host AF_UNIX socket to target (e.g., Docker daemon socket, D-Bus socket).
3. Craft a malicious path: Construct a socket path that passes the relay's workspace validation check — for example, /workspace/legit-dir/target.sock — where legit-dir is a directory the attacker controls within the workspace.
4. Initiate a relay connection request: Trigger the guest-to-host socket relay to begin processing the connection request to the crafted path, starting the validation phase.
5. Race the symlink swap: Immediately after validation passes but before the host reconnects using the pathname, replace the intermediate directory (legit-dir) with a symbolic link pointing to a directory outside the workspace that contains the target host socket (e.g., /var/run/docker.sock).
6. Host connects to arbitrary socket: The host daemon follows the now-redirected path and connects to the attacker-chosen AF_UNIX socket, exposing the capabilities or data of that socket to the guest (GitHub Advisory).

• File System: Unexpected symbolic links appearing in workspace directories, particularly replacing previously normal directories; symlinks pointing outside the workspace boundary (e.g., to /var/run/, /run/, or /tmp/).
• Logs: Docker Sandbox daemon logs showing AF_UNIX socket connections to paths outside the expected workspace directory; errors or anomalies in socket relay logs around path resolution.
• Process: Unusual guest processes rapidly creating and replacing directories with symlinks in the workspace; guest processes communicating with host services (e.g., Docker daemon, D-Bus) that should not be accessible from within the sandbox.

Docker has released a fix in Docker Sandboxes version 0.42.0, which resolves this vulnerability. Users running versions 0.37.0 through 0.41.x should upgrade to v0.42.0 immediately (Docker sbx-releases v0.42.0). As a defense-in-depth measure, organizations should restrict guest-to-host socket relay capabilities to only essential services and implement monitoring for suspicious socket connection attempts from sandbox guests. The fix involves validating the socket path at connection time (not only at initial validation) to prevent symlink-based path traversal between check and use.

Docker published a security announcement covering this and related vulnerabilities (Docker Security Announcements). Security news outlets including GBHackers, SecurityOnline, IT Security News, and CyberPress covered the disclosure, generally characterizing it as a significant sandbox escape class vulnerability that was responsibly patched (GBHackers, SecurityOnline). Community discussion on Mastodon/InfoSec.exchange noted the vulnerability's relevance to AI-assisted development workflows where Docker Sandboxes are increasingly used (Infosec.exchange).