On September 7, Docker released Sandboxes 0.42.0 to address two vulnerabilities that could let a malicious guest break out of the shared workspace on macOS and interact with host resources. The more severe issue, CVE-2026-77179, is rated Critical and affects versions 0.28.0 through 0.41.x on macOS. The second, CVE-2026-79994, is rated High and affects versions 0.37.0 through 0.41.x.

CVE-2026-77179 stems from the virtio-fs host server following symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user — potentially leading to code execution on the host. CVE-2026-79994 involves the guest-to-host Unix domain socket relay: it checks that a socket path is inside an authorized workspace but reconnects using the path name. A guest can replace an intermediate directory with a symlink between the check and the connection, causing the host to connect to an arbitrary AF_UNIX socket outside the workspace and exposing data or host-side capabilities provided by that socket.

Confirmed

  • Docker Sandboxes 0.42.0 released September 7, 2026, fixes both CVEs.
  • CVE-2026-77179 (Critical): virtio-fs symlink follow on macOS allows workspace escape and arbitrary host file read/modify as VMM user. Affected versions: 0.28.0 up to but not including 0.42.0 on macOS.
  • CVE-2026-79994 (High): Unix domain socket relay TOCTOU via symlink swap lets guest connect to arbitrary AF_UNIX sockets outside workspace. Affected versions: 0.37.0 up to but not including 0.42.0.
  • Workaround if immediate update is not possible: use clone mode and avoid adding read-write host mounts.

Unknown

  • Whether either vulnerability has been exploited in the wild.
  • Independent reproduction of the escape chain or the socket relay TOCTOU outside Docker's disclosure.
  • Exact timeline of when the flaws were introduced and when Docker was first notified.

Our take

The virtio-fs symlink issue is a classic host–guest boundary failure on macOS where the VMM user context makes host file access especially potent. The socket relay TOCTOU is a separate but related class of path-resolution race. Both underscore that sandbox isolation on macOS still leans heavily on correct path canonicalization at every reopen and reconnect point — a surface that grows with each shared-filesystem feature. Until independent researchers replicate the escape, treat the Critical rating as Docker's assessment, not a confirmed active campaign.

Sources