Docker Sandboxes VM escape on macOS allows host file access via symlinks

Affected Systems

Docker Sandboxes versions 0.28.0 through 0.41.9 on macOS. CVE-2026-77179 (Critical, CVSS 9.4) affects virtio-fs in versions 0.28.0–0.41.9. CVE-2026-79994 (High, CVSS 8.7) affects Unix socket relay in versions 0.37.0–0.41.9. Both fixed in version 0.42.0.

Exploitation Status

No active exploitation reported. CISA assessment lists exploitation as none. Not in CISA KEV catalog as of September 16, 2026. Exploitation requires malicious code already running inside the sandbox VM.

Business Impact

Organizations using Docker Sandboxes for AI coding agents on macOS face risk of VM escape. Malicious or compromised agents can read or modify arbitrary host files with VMM user privileges, potentially achieving code execution on the host. The second flaw (CVE-2026-79994) allows unauthorized access to Unix domain sockets outside the workspace, exposing host-side capabilities. Risk is elevated in environments where untrusted AI agents or third-party code run inside sandboxes. Windows and Linux platform impact for CVE-2026-79994 is unclear from vendor advisory.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update Docker Sandboxes to version 0.42.0 or later (0.43.0 available as of September 15, 2026) on all macOS hosts immediately.
• If immediate patching is not possible, enable clone mode (--clone flag) for all sandboxes and avoid adding read-write host mounts. Note: clone mode requires Git repositories and protects against writes but not reads.
• Audit existing Docker Sandboxes deployments for versions 0.28.0–0.41.9 on macOS and prioritize systems running untrusted or third-party AI coding agents.
• Review logs for unusual file access patterns or socket connections from Docker Sandboxes VMs, particularly access attempts outside designated project directories.
• Verify that Docker Sandboxes instances on Windows and Linux are also updated to 0.42.0+ as a precaution, given unclear platform scope for CVE-2026-79994.