Docker security advisories, August 2026

Every Docker security advisory published in August 2026, from Docker Security ([email protected] CNA) + NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 2
Critical: 0
High: 1
In CISA KEV: 0
CVEs: 2

Docker advisories published in August 2026

Aug 18, 2026
High [CVE-2026-17106] The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory
High7.1
Aug 12, 2026
Medium [CVE-2026-18171] Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode
Medium5.7

Get an email when Docker publishes the next one.

See Docker's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Docker

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.