Author: DigitalSpying Security Desk
Date: September 18, 2026
Executive Summary
In a crucial vulnerability disclosure impacting modern software developers and AI engineers, Docker has published security updates addressing two severe vulnerabilities in Docker Sandboxes on macOS. As reported by The Hacker News, CyberPress, and CybersecurityNews, the vulnerabilities are tracked as CVE-2026-77179 and CVE-2026-79994.
Docker Sandboxes is an isolation architecture introduced in Docker Desktop that leverages lightweight micro-virtual machines (microVMs) to execute untrusted code, external repository dependencies, and autonomous AI-agent workflows in a contained environment. However, flaws discovered in the macOS host filesystem sharing mechanism (virtio-fs) and local socket bridge allow untrusted code running inside the guest sandbox to escape containment boundaries. A malicious guest environment can read, create, and overwrite arbitrary files across the macOS host operating system and interact with sensitive local Unix domain sockets—completely undermining the core security guarantees of the microVM boundary. The flaws have been addressed in Docker Sandboxes version 0.42.0.
Deep-Dive Technical Analysis
1. Docker Sandboxes & The MicroVM Isolation Model
As developer toolchains increasingly incorporate autonomous AI coding agents and third-party open-source packages, standard containerization (namespaces and cgroups) is often considered insufficient against kernel-level container escapes:
* MicroVM Architecture: Docker Sandboxes deploys micro-virtual machines using native hypervisor virtualization (Apple's Hypervisor.framework on macOS). Each workspace runs a dedicated Linux guest kernel separated from the host kernel.
* Filesystem Sharing via virtio-fs: To allow developers and agents to edit code seamlessly, the host shares a designated project directory with the microVM using virtio-fs (a shared file system protocol designed for virtual machines).
* The Core Flaw (CVE-2026-77179): The vulnerability resides within the host daemon component implementing the virtio-fs server on macOS. Improper canonicalization and insufficient restriction of symbolic links and path traversal primitives within the virtio-fs handler allow guest file system requests to break out of the designated host workspace mount point.
2. The Guest-to-Host Escape Chain
The vulnerability allows an attacker who controls code executing inside the sandbox (e.g., via a compromised npm/pip package, malicious pull request, or autonomous AI agent task) to compromise the underlying developer machine:
1. Crafted Symbolic Link Injection: Inside the guest Linux environment, the attacker creates crafted symlinks or path traversal sequences (../../) targeting the shared virtio-fs mount.
2. Host Daemon Path Dereferencing: When the macOS host virtio-fs server processes file read or write requests from the guest kernel, it evaluates paths without validating that the resolved canonical path remains confined within the shared workspace directory root.
3. Arbitrary Host File Read/Write: The guest can read sensitive host configuration files, including:
* macOS SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519)
* Cloud provider credentials (~/.aws/credentials, ~/.azure/, ~/.config/gcloud/)
* Shell configuration files (~/.zshrc, ~/.bash_profile)
4. Unix Domain Socket Exposure (CVE-2026-79994): The secondary defect enables the guest microVM to bridge network/IPC calls directly to host Unix domain sockets outside the sandbox, including the Docker Engine control socket (/var/run/docker.sock) or 1Password/GPG agent sockets, granting the attacker the ability to control the host Docker daemon or forge cryptographic signatures.
+----------------------------------------------------------------------------------------------------+
| DOCKER SANDBOX MICROVM ESCAPE CHAIN (MACOS) |
|---|
[Untrusted Code / Malicious AI Agent Execution inside MicroVM Guest]
|
| 1. Creates Symlink / Traversal Sequence targeting virtio-fs shared mount point
v
[Guest Kernel virtio-fs Client]
|
| 2. Dispatches File System Request over Virtualization Bus (Hypervisor.framework)
v
[macOS Host virtio-fs Daemon Process]
|
| 3. Logic Defect: Fails to enforce directory boundary checks (CVE-2026-77179)
| Resolves path into host user home directory: /Users/
v
[Full Containment Escape: Host File System Access]
|
+---> Exfiltrates ~/.ssh/id_rsa & ~/.aws/credentials
+---> Overwrites ~/.zshrc to inject persistent reverse shell on host login
|
[Host Unix Domain Socket Bridging (CVE-2026-79994)]
|
+---> Connects to /var/run/docker.sock on macOS host
+---> Spawns root container on host system with volume mount at host root (/)
3. Threat Matrix & Modern AI-Agent Workflow Risks
The discovery of CVE-2026-77179 highlights a growing threat vector in software development:
* Autonomous AI Agent Execution: Organizations increasingly permit autonomous agent frameworks (such as AutoGPT, Claude Code, or Devin-like systems) to clone repositories, install dependencies, and execute terminal commands inside sandboxes. If an AI agent encounters prompt-injected instructions in a GitHub issue or documentation file, the agent can be coerced into triggering the microVM escape.
* Supply Chain Malvertising & Poisoned Packages: Malicious npm, PyPI, or crates.io packages designed to run post-install install scripts (preinstall, setup.py) can break out of developer sandboxes immediately upon dependency resolution.
Vulnerability Metrics & Affected Product Scope
Metric / Parameter
Value
Vulnerability Identifiers
CVE-2026-77179 / CVE-2026-79994
CVSS v3.1 Base Score
8.6 (High Severity) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability Type
MicroVM Sandbox Escape / Path Traversal / Improper Socket Exposure
Affected Component
macOS virtio-fs host daemon in Docker Desktop / Sandboxes
Affected Versions
Docker Sandboxes 0.28.0 through versions prior to 0.42.0 on macOS
Patched Release
Docker Sandboxes 0.42.0
Active Exploitation
Disclosed responsibly via bug bounty; No in-the-wild exploitation reported
Defensive Playbook & Developer Hardening Guidelines
1. Upgrade Docker Sandboxes to Version 0.42.0 Immediately
Developers and enterprise macOS fleets utilizing Docker Desktop must update to version 0.42.0 or higher:
* Open Docker Desktop on macOS, navigate to Settings > Software Updates, and install the latest available patch.
* Verify the installed sandboxes component version via command line:
docker sandbox version
2. Isolate Sensitive Developer Credentials
Developers running untrusted code should implement defense-in-depth credential isolation:
* Use Hardware-Backed SSH Keys: Migrate from file-based private keys (~/.ssh/id_ed25519) to hardware-backed FIDO2 / Secure Enclave keys (ed25519-sk), which require physical user presence (touching a YubiKey or Touch ID) for every signature operation, preventing stolen key files from being utilized off-device.
* Scoped Cloud IAM: Avoid persistent static AWS or GCP access keys stored in ~/.aws/credentials. Enforce short-lived, role-based credentials generated via Single Sign-On (AWS IAM Identity Center / aws sso login).
3. File Integrity Monitoring on macOS Workstations
* Enforce Endpoint Detection and Response (EDR) or fs_usage monitoring on macOS to alert whenever Docker processes attempt to access files outside /Users/
Sources and Reference Intelligence: The Hacker News, CyberPress, CybersecurityNews.