A sandbox built to keep AI coding agents contained inside a Mac has leaked past its own boundary, letting code inside one small virtual machine reach files across the rest of the host.
Docker’s September 15 notice covers macOS builds of its Sandboxes from 0.28.0 up to the release that closed the hole, version 0.42.0, shipped September 7. The flaw is tracked as CVE-2026-77179 and rated critical.
How a guest steps past the shared folder
The escape travelled through virtio-fs, the host component that shares the project directory with the virtual machine. It followed symlinks when reopening a removed file from a stored path, so a guest could swap a parent directory for a symlink and then read or change files with the rights of the account running the virtual machine monitor. Docker says that can end in code execution on the host.
The same update closed a socket relay problem, tracked as CVE-2026-79994 and rated high with an 8.7 score. In versions 0.37.0 through 0.41.9 the relay verified that a path sat inside the workspace and then dialled it by name, so a guest that swapped a directory for a symlink in the gap could redirect the host to any socket outside that folder.
No exploitation reported and a patched release to install
Docker reports no exploitation of either flaw, and neither appears in CISA’s Known Exploited Vulnerabilities catalog. Credit goes to Oren Yomtov at accomplish.ai and Jurre van Bergen at ThreatNotify.
Release notes for 0.42.0 never name either CVE. One routine entry describes a sandboxed process that could talk the daemon into opening a host D-Bus transport and running a command there, and Docker has not tied that fix to either record. The read-only clone setting protects tracked code only, since stray repository files stay readable from inside.
