High [CVE-2026-103916] Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace
This high-severity Docker advisory covers CVE-2026-103916 affecting Docker Sandboxes.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Docker Docker Desktop publishes the next one.
See Docker Docker Desktop's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
- Docker Sandboxes 0.28.0 before 0.51.0
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
Mitigation checklist
- A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
More Docker advisories
- CVE-2026-121614Nov 3, 2026Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git
- CVE-2026-105452Oct 8, 2026Docker Sandboxes could forward a client-supplied credential alongside a credential
- CVE-2026-101998Oct 8, 2026Docker Sandboxes could fail open while masking credentials in protected proxy responses
- CVE-2026-105570Oct 8, 2026Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding
- CVE-2026-79994Sep 15, 2026The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket
- CVE-2026-77179Sep 15, 2026On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks
Android app · Google Play
Monitor future Docker CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.