Vulnerability · Published Sep 15, 2026 · Assigned by Docker
CVE-2026-79994Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race
High 8.7
In plain English
A high-severity security flaw in Docker Sandboxes from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.04:LTS | docker.io | no fix listed | UBUNTU-CVE-2026-79994 |
| Ubuntu:26.10 | docker.io | no fix listed | UBUNTU-CVE-2026-79994 |
| Ubuntu:26.04:LTS | docker.io-app | no fix listed | UBUNTU-CVE-2026-79994 |
| Ubuntu:26.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-79994 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Sandboxes | 0.37.0 – before 0.42.0 |
Weakness: CWE-367 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N