A Docker vulnerability tracked as CVE-2026-17106 allows malicious containers to overwrite files on the host machine and achieve root code execution under specific conditions. The flaw affects the docker cp command and related sbx cp command used in Docker Sandboxes for AI-agent workflows, exploiting a filesystem race condition with a flawed symlink check. This design assumes two things hold true: the daemon produces a consistent archive, and the CLI keeps every extracted file inside the destination the user chose. An attacker can manipulate files mid-scan by chaining the race condition with the flawed symlink check. The vulnerability directly threatens CI/CD pipelines, developer workstations, and incident-response workflows because docker cp underpins routine tasks like collecting build artifacts, logs, and forensic evidence. On macOS, attackers could overwrite shell startup scripts, SSH configuration, or LaunchAgents to achieve code execution the next time a terminal opens. On Linux, if docker cp runs with elevated privileges, the same write primitive can replace system binaries like runc, converting a file overwrite into immediate root access. The flaw affects Docker Engine and CLI 29.7.1 and earlier, as well as Docker Desktop 4.85.9 and earlier, and Docker Sandboxes 0.37.9 and earlier.
We recommend you update Docker Engine and CLI to version 29.7.2, Docker Desktop to version 4.86.0, and Docker Sandboxes to version 0.38.0.[/subscribe_to_unlock_form]
A Docker vulnerability tracked as CVE-2026-17106 allows malicious containers to overwrite files on the host machine and achieve root code execution under specific conditions. The flaw affects the docker cp command and related sbx cp command used in Docker Sandboxes for AI-agent workflows, exploiting a filesystem race condition with a flawed symlink check. This design assumes two things hold true: the daemon produces a consistent archive, and the CLI keeps every extracted file inside the destination the user chose. An attacker can manipulate files mid-scan by chaining the race condition with the flawed symlink check. The vulnerability directly threatens CI/CD pipelines, developer workstations, and incident-response workflows because docker cp underpins routine tasks like collecting build artifacts, logs, and forensic evidence. On macOS, attackers could overwrite shell startup scripts, SSH configuration, or LaunchAgents to achieve code execution the next time a terminal opens. On Linux, if docker cp runs with elevated privileges, the same write primitive can replace system binaries like runc, converting a file overwrite into immediate root access. The flaw affects Docker Engine and CLI 29.7.1 and earlier, as well as Docker Desktop 4.85.9 and earlier, and Docker Sandboxes 0.37.9 and earlier.
We recommend you update Docker Engine and CLI to version 29.7.2, Docker Desktop to version 4.86.0, and Docker Sandboxes to version 0.38.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]