Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE Docker Sandboxes: host file read and write via symlink in cp command (CVE-2026-103916) A malicious sandbox can read or overwrite host files beyond the workspace using the invoking user's privileges. Patch → 0.51.0 https://cve.now/CVE-2026-103916?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
An AI agent sandbox is only as strong as its copy command. @Docker Sandboxes CVE-2026-103916 (via @EndorLabs): sbx cp followed symlinks, so a prompt-injected agent could reach host creds and SSH keys. Upgrade to 0.51.0. I'd add a symlink-escape test to every agent sandbox eval.
Endor Labs researcher Peyton Kennedy found a Docker Sandboxes flaw (CVE-2026-103916) that lets AI coding agents bypass file restrictions to read or modify cloud credentials and SSH keys. Docker’s fix is in v0.48.0. Upgrade once available. https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916 https://t.co/VrTZ600u6l
CVE advisory: CVE-2026-103916 - docker: Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory. https://vulnipulse.com/advisories/docker-cve-2026-103916 #CVE #CyberSecurity #Docker #DockerSandboxes
@Docker @EndorLabs Write-up from Endor Labs researcher Peyton Kennedy: https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916