CVE-2026-18171: falha de média gravidade em Docker Sandboxes
Docker Sandboxes read-only runtime mount writable through its shared-export alias
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.7epss 0.1%
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Docker · Docker SandboxesCVEs relacionadas — Docker Sandboxes
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17106HIGHTar extraction in moby/go-archive can write outside the destination directory via link followingEPSS 0.4%CVE-2026-103916HIGHDocker Sandboxes sbx cp follows workspace symlinks outside the authorized host directoryEPSS 0.2%CVE-2026-77179CRITICALDocker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallbackEPSS 0.2%CVE-2026-101998MEDIUMFail-open response masking in Docker Sandboxes can expose proxy-managed credentialsEPSS 0.2%CVE-2026-105452MEDIUMDocker Sandboxes egress proxy could forward unrecognized client credentials to managed hostsEPSS 0.1%CVE-2026-12539MEDIUMDocker Sandboxes ICMP egress restriction bypass after daemon restartEPSS 0.1%