CVE-2026-126329
Docker Sandboxes privilege escalation through untrusted state directories
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0.
| CWE | CWE-282 |
| Vendor | docker |
| Product | docker sandboxes |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for docker docker sandboxes
Be the first to know when new unknown vulnerabilities affecting docker docker sandboxes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Docker / Docker Sandboxes
0.7.0 < 0.53.0
Credits
Ryan Selikow