# Docker security vulnerabilities and escape flaws

> Live situation record from CLSTR: https://clstr.news/situations/docker-security-vulnerabilities-and-escape-flaws
> Updated: 2026-09-29T04:15:48.000Z. Sources: 4. Developments: 2.

Docker has addressed several critical security vulnerabilities involving sandbox and container escapes. Initial reports identified flaws in Docker Sandboxes, including CVE-2026-79994, a high-severity Unix socket exploit involving a race condition, and CVE-2026-77179, which allowed macOS users to experience file escapes via the virtio-fs host server. 

Subsequent findings detailed a critical vulnerability known as ‘CopyEscape’ (CVE-2026-17106). Discovered by Imperva’s Red Team, this flaw occurs during ‘docker cp’ copy-out operations. It leverages a race condition and a failure in the Docker CLI to restrict filesystem operations, potentially allowing malicious containers to overwrite files on a host machine. These incidents underscore architectural concerns regarding container security and the limitations of isolation when sharing a host operating system's kernel.

## Timeline

### 2026-09-29: Docker CopyEscape vulnerability allows host file overwrites

A critical Docker vulnerability known as ‘CopyEscape’ (CVE-2026-17106) allows malicious containers to overwrite host files via the ‘docker cp’ command, highlighting risks in shared-kernel container architecture

2 sources. https://clstr.news/cluster/docker-copyescape-vulnerability-allows-host-file-overwrites

### 2026-09-17: Docker patches critical Sandboxes vulnerabilities

Docker has patched critical vulnerabilities in Docker Sandboxes that allowed malicious code to escape isolation via Unix socket exploits and symlink manipulation, potentially affecting host files on macOS.

2 sources. https://clstr.news/cluster/docker-patches-critical-sandboxes-vulnerabilities

---
Cite as: Docker security vulnerabilities and escape flaws. CLSTR, https://clstr.news/situations/docker-security-vulnerabilities-and-escape-flaws