CVE-2026-79994
Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.
| CWE | CWE-367 |
| Vendor | docker |
| Product | docker sandboxes |
| Ecosystems | |
| Industries | Technology |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for docker docker sandboxes
Be the first to know when new unknown vulnerabilities affecting docker docker sandboxes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Docker / Docker Sandboxes
0.37.0 < 0.42.0
References
docs.docker.com: https://docs.docker.com/ai/sandboxes/ docs.docker.com: https://docs.docker.com/ai/sandboxes/security/isolation/ github.com: https://github.com/docker/sailor/pull/2021 github.com: https://github.com/docker/sandboxes/pull/5342 github.com: https://github.com/docker/sbx-releases/releases/tag/v0.42.0
Credits
Jurre van Bergen of ThreatNotify