Vulnerability · Published Aug 12, 2026 · Assigned by Docker
CVE-2026-18171Docker Sandboxes read-only runtime mount writable through its shared-export alias
Medium 5.7
In plain English
A medium-severity incorrect authorization in Docker Sandboxes from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Sandboxes | 0.35.0 – through 0.38.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N