CVE-2026-79994
High
Description
The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.
SeverityHigh
CVSS8.7
Exploit probability—
Product
Docker Sandboxes
PublishedSep 15, 2026
First seenSep 15, 2026
Weakness typeCWE-367CWE-367
How to fix
Update
- docker docker_sandboxes0.42.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker docker_sandboxes | 0.37.0 ≤ v < 0.42.0 | 0.42.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.