CVE-2026-79994Patch

MEDIUMCVSS 8.7 · HIGH

Exploitation observed; activity peaked at 9 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.

Back to dashboard

5.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-367

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
26 mentions across 10 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 20 signals
Technical details provided in 19 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 8d ago at 9 mentions (2026-09-17); latest day: 1
26 total mentions across 10 days

Deep dive

Activity timeline26 mentions / 10d

Signal classification5 categories

Patch

1869.2%

Disclosure

311.5%

General

27.7%

PoC

27.7%

Active Exploitation

13.8%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-16	1	Patch1
2026-09-17	9	Active Exploitation1Disclosure1General1Patch6
2026-09-18	3	Patch3
2026-09-19	3	Disclosure1Patch1PoC1
2026-09-20	2	Patch2
2026-09-21	3	Patch3
2026-09-22	2	Patch1PoC1
2026-09-23	1	Disclosure1
2026-09-28	1	Patch1
2026-10-15	1	General1

Full discourse20 posts

elhacker.NET@elhackernet45d
Patch
Vulnerabilidades críticas en Docker permiten escapar de microVMs aisladas Docker ha solucionado dos vulnerabilidades graves (CVE-2026-77179 y CVE-2026-79994) en Docker Sandboxes https://blog.elhacker.net/2026/09/vulnerabilidades-criticas-en-docker.html
Post summary
The text discloses two critical Docker vulnerabilities (CVE-2026-77179 and CVE-2026-79994) enabling microVM escape and notes that Docker has patched them, with a reference to a blog post for further details.
116056124.7K
142.5K followersView on X
Jurre van Bergen@DrWhax43d
PoC
Details + PoC for CVE-2026-79994 here: https://github.com/Threatnotify/vulnerabilities/tree/main/CVE-2026-79994
Post summary
The text announces CVE-2026-79994 and links to a GitHub repository containing a Proof of Concept, but provides no technical details, exploit tools, patches, or active exploitation evidence in the post itself.
0001072.5K
5.1K followersView on X
Jurre van Bergen@DrWhax43d
Patch
This is now patched as CVE-2026-79994. Update to Docker SBX 0.42.0. Write-up is coming!
Post summary
The text focuses on the patching of CVE-2026-79994, recommending an update to Docker SBX 0.42.0, with a write-up anticipated.
3101021.8K
5.1K followersView on X
Kyle Q (the DockerSlim guy)@kcqon45d
Disclosure
Containers don't contain, but VMs don't contain either :-) Latest example, Docker Sandboxes where a vulnerability in virtio-fs host server allows a host breakout / code execution (CVE-2026-77179). There's also CVE-2026-79994, another symlink related bug (with Unix domain sockets).
Post summary
The text discloses two vulnerabilities (CVE-2026-77179 and CVE-2026-79994) with technical details about their potential impact, including host breakout and symlink-related issues in Docker Sandboxes. It focuses on announcing the vulnerabilities rather than PoCs, exploits, patches, or active exploitation.
300112448
1.6K followersView on X
Jintao Zhang 张晋涛@aiandcloud43d
Disclosure
现在各家都在搞 sandbox，睡前顺手发两个高危漏洞，大家也方便自查一下。 CVE-2026-77179 和 CVE-2026-79994，评分 9.4 和 8.7 ，正好在打 Docker Sandbox。当然，最近还有很多其他的，都没幸免 🤣 过些天看情况再说 https://t.co/9sn4KwCE6I
Post summary
The tweet announces two high-severity CVEs (9.4 and 8.7) targeting Docker Sandbox with CVSS scores, encouraging self-check, and links to more details without providing PoC, exploit, or patch information.
210721.4K
3.3K followersView on X
Hazem Omier@hazemomier42d
Patch
Docker Sandboxes (microVM layer for Claude Code / Codex / Cursor / Copilot / etc.) closed two macOS host escapes: • CVE-2026-77179 (CVSS 9.4): virtio-fs symlink race → read/modify arbitrary host files as the VMM user • CVE-2026-79994 (8.7): Unix-socket relay TOCTOU → arbitrary AF_UNIX on the host Fixed in 0.42.0 (also D-Bus host-command + cross-sandbox OAuth hijack). Docs said symlinks outside the workspace aren't followed. They were — at reopen time, not check time. CTO take: a sandbox promise is only as real as the path the guest reuses after the check. Upgrade; until then prefer clone mode over RW mounts.
Post summary
Two macOS host‑escape vulnerabilities in Docker Sandboxes (CVE‑2026‑77179 and CVE‑2026‑79994) are disclosed with technical details and CVSS scores, and are confirmed to be fixed in version 0.42.0, with an upgrade and clone‑mode recommendation until the patch is applied.
40050188
493 followersView on X
Vikram Dias@BigVikDada40d
PoC
Docker assigned CVE-2026-77179 to its own Sandboxes product. On macOS, the virtio-fs host server followed a symlink when it reopened an unlinked file from a stored path. A guest that could replace a parent directory walked out of the shared workspace and read or wrote host files as the VMM user. Docker’s own record says that can become host code execution. Affected: Sandboxes 0.28.0 through anything before 0.42.0. Researcher Oren Yomtov at Accomplish said three lines of bash were enough. They reported it 12 Aug 2026. Docker confirmed two days later. Desktop 4.88.0 shipped 24 Aug with sailor 0.118.0. Sandboxes 0.42.0 shipped 7 Sep. The CVE record published 15 Sep. 0.42.0 also closed CVE-2026-79994, a socket-relay race. That one made the release notes. The virtio-fs write did not. Workaround language on the CVE card: use --clone and do not add extra read-write host mounts. No public KEV as of 22 Sep 2026. CISA-ADP SSVC on the record: exploitation none, automatable no, technical impact total. What it is not: a fleet-wide unauthenticated RCE. You need guest code that can touch the shared workspace. That is still the default path if you let an agent or untrusted repo run inside the sandbox with a bind mount. What I would take into the room: 1. On every Mac that runs Sandboxes, run sbx --version. Anything under 0.42.0 is the list. Desktop needs 4.88.0 or later, and Settings → General → Virtual Machine Manager should not be an older Docker VMM. 2. Inventory extra read-write host mounts. If the job can run --clone, that is the temporary control, not a policy essay. 3. Treat “sandbox” as the VMM user’s filesystem rights until you can screenshot the version. Keys, SSH agent sockets, and .env files in the home directory are in scope. 4. Ask one numbered vendor question: which 0.42.0 note maps to CVE-2026-77179, and did Desktop 4.88.0 and Sandboxes 0.42.0 ship the same virtio-fs change? Primary: CVE-2026-77179, Docker Inc. CNA, updated 15 Sep 2026. https://www.cve.org/CVERecord?id=CVE-2026-77179 Researcher write-up: Oren Yomtov, “Guest to host: escaping Docker’s hypervisor,” Accomplish, 19 Sep 2026. https://accomplish.ai/blog/escaping-dockers-hypervisor/ Fix tag: Docker Sandboxes v0.42.0. https://github.com/docker/sbx-releases/releases/tag/v0.42.0 Anyone already forcing 0.42.0 / Desktop 4.88.0 on Macs that let agents write into a bind-mounted workspace? #Docker #CVE202677179 #MacOS
Post summary
Docker Sandboxes CVE‑2026‑77179 is disclosed with a concise PoC (three lines of bash) that exploits symlink handling on macOS to escape the sandbox and read/write host files, and the issue is mitigated in version 0.42.0 (Desktop 4.88.0) with a recommended --clone workaround.
40031167
161 followersView on X
Threat Landscape@LandscapeThreat45d
Patch
Docker disclosed two Docker Sandboxes vulnerabilities that can allow malicious guest environments to escape workspace isolation and access host resources. CVE-2026-77179, affecting macOS versions before 0.42.0, enables symlink-race redirection of filesystem operations, potentially permitting arbitrary file read/write and host code execution. CVE-2026-79994, affecting versions before 0.42.0, can redirect guest-to-host Unix socket connections to unauthorized AF_UNIX sockets, enabling data disclosure or access to host-side functions. Docker recommends upgrading to 0.42.0 or later, using clone mode, removing writable host mounts, and minimizing sensitive data in shared paths. VULNERABILITY CVE-2026-17106 CVE-2026-2664 CVE-2026-28400 CVE-2026-33990 CVE-2026-5817 CVE-2026-5843 CVE-2026-77179 CVE-2026-79994
Post summary
Docker disclosed two sandbox vulnerabilities detailing filesystem and socket redirection risks, and explicitly recommends upgrading to version 0.42.0 along with specific workarounds as remediation.
2004175
120 followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
Docker released an update for critical Docker Sandboxes vulnerabilities (CVE-2026-77179, CVE-2026-79994). Patch these Docker Sandboxes vulnerabilities today. #Docker #DockerSandboxes #CVE202677179 #CVE202679994 #Cybersecurity https://securityonline.info/docker-sandboxes-vulnerabilities-patched/
Post summary
The text announces that Docker released an update for critical Docker Sandboxes vulnerabilities (CVE-2026-77179, CVE-2026-79994) and explicitly urges users to patch immediately. No exploit tools, PoCs, active exploitation claims, or detailed technical vulnerability information are provided.
00023447
13.0K followersView on X
The CyberSec Guru@thecybersecguru44d
Patch
🚨 Docker Sandboxes has a serious security problem. Two vulnerabilities, CVE-2026-77179 and CVE-2026-79994, can break the isolation protecting AI coding agents and expose host-level files and Unix sockets. CVE-2026-77179 carries a CVSS 9.4 Critical rating. CVE-2026-79994 is rated High at 8.7. Both were fixed in Docker Sandboxes 0.42.0. (Docker Documentation) AI agents + sandbox escape = a nasty combination. Full breakdown 👇 https://thecybersecguru.com/news/docker-sandboxes-cve-2026-77179-cve-2026-79994/ #Docker #CyberSecurity #AISecurity #CVE #InfoSec
Post summary
The tweet discloses two CVEs in Docker Sandboxes with high CVSS scores, explains they allow sandbox escape, and notes they were patched in version 0.42.0.
10110214
1.6K followersView on X
Rıdvan Yağlı@ridvanyagli45d
Patch
🚨 Docker Sandboxes'ta kritik sandbox escape açığı Docker Sandboxes'ta keşfedilen CVE-2026-77179, kötü niyetli kodun sandbox izolasyonunu aşarak macOS host üzerindeki dosyaları okumasına/değiştirmesine, potansiyel olarak host üzerinde kod çalıştırmasına yol açabiliyor. 🔴 CVSS: 9.4 (Critical) 💻 Etkilenen: 0.28.0 – 0.41.x (macOS) ✅ Düzeltilen sürüm: 0.42.0 Ayrıca CVE-2026-79994 (CVSS 8.7) adlı ikinci sandbox-to-host açığı da 0.42.0'da düzeltildi. Docker Sandboxes kullananların 0.42.0 veya üzeri sürümlere geçmesi öneriliyor.
Post summary
The post discloses critical sandbox escape vulnerabilities CVE-2026-77179 (CVSS 9.4) and CVE-2026-79994 (CVSS 8.7) in Docker Sandboxes affecting macOS, while explicitly recommending upgrading to version 0.42.0 as the remediation fix.
00021345
2.5K followersView on X
Chris Short@ChrisShort41d
Patch
Docker Sandboxes 0.42.0 security update: CVE-2026-77179 and CVE-2026-79994 #devopsish https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994
Post summary
The post announces a Docker Sandboxes security update for CVE-2026-77179 and CVE-2026-79994, linking to the vendor advisory. It provides no technical details, PoCs, or evidence of active exploitation.
00011352
19.4K followersView on X
BT Haberler@BTHaberler41d
Patch
Docker Sandboxes'taki İki Açık, macOS'ta Sanal Makine İçindeki Kötü Amaçlı Kodun Ana Bilgisayar Dosyalarına Erişmesine İzin Veriyordu! Docker Sandboxes'ta bulunan CVE-2026-77179 (CVSS 9.4) ve CVE-2026-79994 (CVSS 8.7), sanal makine içinde çalışan kötü amaçlı kodun, symlink takibi yoluyla macOS ana bilgisayarındaki proje dizini dışındaki dosyaları okuyup değiştirmesine izin veriyordu; açıklar sırasıyla virtio-fs host sunucusunda ve Unix socket geçiş sisteminde bulunuyordu. • Saldırgan, sandbox içindeki dizin yapısını sembolik bağlantılarla değiştirerek ana bilgisayarın dosya sistemine erişim kazanabiliyordu; bu da sandbox izolasyonunun temel amacını (host'u korumak) baştan aşağı geçersiz kılıyordu. • Sorun, Docker Sandboxes 0.42.0 sürümüyle giderildi; henüz yaygın istismar bildirilmedi ama açığın tetiklenmesi için sandbox içinde kod çalıştırabilen bir "içeriden" tehdit yeterli. AI kod asistanlarının ve geliştirme araçlarının giderek daha fazla sandbox içinde otonom kod çalıştırdığı bir dönemde, sandbox'ın kendisindeki bir izolasyon açığının ana bilgisayarı doğrudan tehlikeye atabilmesi, "sandbox'a güven" varsayımının da düzenli olarak test edilmesi gerektiğini gösteriyor. #SiberGüvenlik #Docker #Sandbox
Post summary
The post discloses two Docker Sandboxes CVEs enabling symlink-based host file access from macOS VMs, notes they were patched in version 0.42.0, and reports no widespread exploitation observed.
1001061
44 followersView on X
sunil kumawat@Sunil_kumawat1744d
Patch
Root cause: virtio-fs followed symlinks reopening an unlinked path. Affects Sandboxes 0.28.0 through before 0.42.0 on macOS. 0.42.0 also fixes CVE-2026-79994 (High, CVSS 8.7) in the Unix socket relay. No confirmed exploitation / not in CISA KEV — sandbox boundary is the point.
Post summary
Virtio-fs sandbox vulnerabilities affected macOS versions 0.28.0 through 0.41.x, while 0.42.0 provides fixes. There is no reported in-the-wild exploitation or associated PoC/exploit code.
1001060
23 followersView on X
Nishanth@Nishanth_KJ40d
Disclosure
Docker issued warnings about symlink escapes (CVE-2026-77179) and TOCTOU race conditions in Unix sockets (CVE-2026-79994). Are your containers handling resource creation atomically? #Docker #CVE #TOCTOU #DevOps
Post summary
The tweet announces Docker's warnings about two CVEs involving symlink escapes and TOCTOU race conditions, focusing on technical vulnerability details and a DevOps-related query.
0001048
65 followersView on X
sunil kumawat@Sunil_kumawat1740d
Patch
@DrWhax Same 0.42.0 train also fixes CVE-2026-79994: Unix-socket relay checked workspace path then reconnected by name—symlink TOCTOU could hit any host AF_UNIX socket. Confirm you’re actually on ≥0.42.0.
Post summary
The tweet announces that version 0.42.0 resolves CVE-2026-79994, detailing a symlink TOCTOU vulnerability in Unix-socket relay logic and advising users to upgrade.
1000044
23 followersView on X
ThaiCERT By NCSA@ThaiCERTByNCSA42d
Patch
แจ้งเตือน! ช่องโหว่ใน Docker Sandboxes บน macOS เสี่ยงถูกอ่านหรือแก้ไขไฟล์บนเครื่องหลัก ผู้ใช้งานควรอัปเดตทันที ศูนย์ประสานการรักษาความมั่นคงปลอดภัยระบบคอมพิวเตอร์แห่งชาติ (ThaiCERT) ได้ติดตามรายงานช่องโหว่ใน Docker Sandboxes จำนวน 2 รายการ ได้แก่ CVE-2026-77179 ซึ่งอาจทำให้โค้ดอันตรายที่ทำงานภายใน Sandbox อ่านหรือแก้ไขไฟล์บนเครื่อง macOS นอกโฟลเดอร์ที่อนุญาต และ CVE-2026-79994 ซึ่งอาจทำให้ Sandbox เข้าถึงช่องทางสื่อสารของเครื่องหลักนอกพื้นที่ที่กำหนด ช่องโหว่ทั้งสองรายการได้รับการแก้ไขแล้วในเวอร์ชัน 0.42.0 ผู้ใช้งานจึงควรตรวจสอบเวอร์ชันและอัปเดตโดยเร็ว [1] 1. รายละเอียดช่องโหว่ 1.1 CVE-2026-77179 (CVSS v4.0: 9.4) [2] เป็นช่องโหว่ในส่วนแบ่งปันไฟล์ระหว่าง Docker Sandboxes กับเครื่อง macOS หากมีโค้ดอันตรายทำงานอยู่ภายใน Sandbox โค้ดดังกล่าวอาจอ่านหรือแก้ไขไฟล์บนเครื่องหลักที่อยู่นอกโฟลเดอร์งานที่แชร์ไว้ โดยใช้สิทธิ์ของบัญชีผู้ใช้ที่รัน Sandbox และอาจนำไปสู่การรันโค้ดบนเครื่องหลัก 1.2 CVE-2026-79994 (CVSS v4.0: 8.7) [3] เป็นช่องโหว่ในส่วนเชื่อมต่อ Unix socket ระหว่าง Sandbox กับเครื่องหลัก โค้ดอันตรายภายใน Sandbox อาจทำให้เครื่องหลักเชื่อมต่อกับ socket นอกพื้นที่ที่อนุญาต ส่งผลให้ข้อมูลหรือความสามารถที่ socket นั้นให้บริการถูกเข้าถึงโดยไม่ได้รับอนุญาต 1.3 การใช้ประโยชน์จากช่องโหว่ทั้งสองรายการต้องมีโค้ดอันตรายทำงานอยู่ภายใน Sandbox ก่อน เช่น โค้ดที่ AI coding agent ดาวน์โหลดหรือรัน ทั้งนี้ ณ วันที่ 18 กันยายน 2569 ยังไม่มีรายงานยืนยันว่าช่องโหว่ดังกล่าวถูกนำไปใช้โจมตีจริง 2. ผลิตภัณฑ์ที่ได้รับผลกระทบ 2.1 CVE-2026-77179 ส่งผลกระทบต่อ Docker Sandboxes บน macOS ตั้งแต่เวอร์ชัน 0.28.0 จนถึงก่อน 0.42.0 2.2 CVE-2026-79994 ส่งผลกระทบต่อ Docker Sandboxes ตั้งแต่เวอร์ชัน 0.37.0 จนถึงก่อน 0.42.0 โดยประกาศของ Docker ไม่ได้ระบุว่าจำกัดเฉพาะระบบปฏิบัติการใด 3. แนวทางการแก้ไข [4] 3.1 ตรวจสอบเวอร์ชัน Docker Sandboxes ที่ใช้งาน และเร่งอัปเดตเป็น เวอร์ชัน 0.42.0 หรือใหม่กว่า 3.2 ตรวจสอบโครงการและไฟล์ที่นำเข้า Sandbox โดยเฉพาะไฟล์ที่มีข้อมูลรับรองหรือความลับ เช่น .env และหลีกเลี่ยงการให้ AI coding agent รันโค้ดหรือแพ็กเกจจากแหล่งที่ไม่เชื่อถือ 3.3 หากสงสัยว่าเคยรันโค้ดอันตรายในเวอร์ชันที่ได้รับผลกระทบ ให้ตรวจสอบการเปลี่ยนแปลงไฟล์บนเครื่องหลักและประเมินว่าข้อมูลสำคัญใดอาจถูกเข้าถึง 4. แนวทางปฏิบัติกรณีไม่สามารถอัปเดตได้ 4.1 ใช้ clone mode และหลีกเลี่ยงการเชื่อมต่อโฟลเดอร์บนเครื่องหลักเข้ากับ Sandbox แบบที่เขียนข้อมูลได้ ตามคำแนะนำของ Docker 4.2 ตรวจสอบไฟล์ในโครงการก่อนใช้ clone mode เนื่องจากโหมดดังกล่าวช่วยป้องกันการแก้ไขโครงการ แต่ไฟล์บางประเภทในโครงการยังอาจถูกอ่านจากภายใน Sandbox ได้ 4.3 จำกัดการใช้งาน Sandbox กับโค้ดหรือโครงการที่ไม่เชื่อถือจนกว่าจะอัปเดตเสร็จ ทั้งนี้ มาตรการชั่วคราวไม่สามารถทดแทนการอัปเดตเวอร์ชันได้ แหล่งอ้างอิง [1] https://dg.th/28h5nyrteo [2] https://dg.th/dx45ayosuk [3] https://dg.th/94yxhlrdqw [4] https://dg.th/j29l3cbdp4 กรณีพบเหตุการณ์ภัยคุกคามทางไซเบอร์ หรือพฤติกรรมน่าสงสัย Email: thaicert@ncsa.or.th โทร. 02 114 3531 (ตลอด 24 ชั่วโมง) ด้วยความปรารถนาดี สำนักงานคณะกรรมการการรักษาความมั่นคงปลอดภัยไซเบอร์แห่งชาติ (สกมช.) / ThaiCERT #ThaiCERT #NCSA #DockerSandboxes #CVE202677179 #CVE202679994 #CyberSecurity #SecurityAlert #PatchNow #ช่องโหว่ความปลอดภัย #แจ้งเตือนภัยไซเบอร์
Post summary
ThaiCERT advisories on two high-severity Docker Sandbox vulnerabilities (CVE-2026-77179, CVE-2026-79994) affecting macOS, with fixed version 0.42.0 and workarounds provided; no active exploitation confirmed and no PoC or exploit tool named.
00010107
67 followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
Major warning for developers: two serious flaws in Docker Sandboxes allow guest code to escape the project directory and access or modify macOS host files. These affect versions up to 0.41.9, with a Critical issue in virtio-fs (CVE-2026-77179) and a High-severity socket-relay bug (CVE-2026-79994). If you’re running these, upgrade to 0.42.0 or later and consider using clone mode. #Security #Docker #macOS #Vulnerability #TechNews #Docker #macOS #Security #SandboxEscape #Vulnerability #AI #DevOps https://thedailytechfeed.com/critical-docker-flaws-let-guests-break-out-of-sandboxes-on-macos/
Post summary
The text reports two serious Docker sandbox escape vulnerabilities (CVE-2026-77179 and CVE-2026-79994) affecting macOS, provides technical details and severity ratings, and recommends upgrading to version 0.42.0 or later as remediation.
0001062
741 followersView on X
The Daily Tech Feed@dailytechonx45d
Active Exploitation
New Docker Sandboxes zero-days CVE-2026-77179 (Critical) & CVE-2026-79994 (High) exposed macOS users via path/symlink & UNIX socket race-conditions in virtio-fs. Upgrade to version 0.42.0. Avoid writable host mounts and use clone mode until patched. #Security #Docker #microVM #Vulnerability #AIWorkload #macOS #Docker #Security #microVM #Vulnerability #macOS #AIWorkloads https://thedailytechfeed.com/critical-docker-sandboxes-zero-days-let-guests-escape-microvms/
Post summary
The tweet announces two critical Docker Sandbox zero-day CVEs affecting macOS users via virtio-fs race-condition vulnerabilities, claims users have been exposed (indicating active exploitation), and provides remediation steps including upgrading to version 0.42.0 and using clone mode as a workaround.
1000077
741 followersView on X
denonccs@denonccs18d
General
@Docker Let's talk about Docker "isolation" another time... https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994
Post summary
The tweet is a brief criticism of Docker's isolation referencing CVE-2026-77179 and CVE-2026-79994 via a link to a Docker security announcement, but provides no PoC, exploit details, patch information, or technical vulnerability specifics in the text itself.
00000127
2.4K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-79994

Kyle Q (the DockerSlim guy)[verified]@kcqonDisclosure

The text discloses two vulnerabilities (CVE-2026-77179 and CVE-2026-79994) with technical details about their potential impact, including host breakout and symlink-related issues in Docker Sandboxes. It focuses on announcing the vulnerabilities rather than PoCs, exploits, patches, or active exploitation.

Hazem Omier[verified]@hazemomierPatch

Two macOS host‑escape vulnerabilities in Docker Sandboxes (CVE‑2026‑77179 and CVE‑2026‑79994) are disclosed with technical details and CVSS scores, and are confirmed to be fixed in version 0.42.0, with an upgrade and clone‑mode recommendation until the patch is applied.

Vikram Dias[verified]@BigVikDadaPoC

Docker Sandboxes CVE‑2026‑77179 is disclosed with a concise PoC (three lines of bash) that exploits symlink handling on macOS to escape the sandbox and read/write host files, and the issue is mitigated in version 0.42.0 (Desktop 4.88.0) with a recommended --clone workaround.

Threat Landscape[verified]@LandscapeThreatPatch

Docker disclosed two sandbox vulnerabilities detailing filesystem and socket redirection risks, and explicitly recommends upgrading to version 0.42.0 along with specific workarounds as remediation.

The CyberSec Guru[verified]@thecybersecguruPatch

The tweet discloses two CVEs in Docker Sandboxes with high CVSS scores, explains they allow sandbox escape, and notes they were patched in version 0.42.0.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post discloses critical sandbox escape vulnerabilities CVE-2026-77179 (CVSS 9.4) and CVE-2026-79994 (CVSS 8.7) in Docker Sandboxes affecting macOS, while explicitly recommending upgrading to version 0.42.0 as the remediation fix.

Chris Short[verified]@ChrisShortPatch

The post announces a Docker Sandboxes security update for CVE-2026-77179 and CVE-2026-79994, linking to the vendor advisory. It provides no technical details, PoCs, or evidence of active exploitation.

BT Haberler[verified]@BTHaberlerPatch

The post discloses two Docker Sandboxes CVEs enabling symlink-based host file access from macOS VMs, notes they were patched in version 0.42.0, and reports no widespread exploitation observed.