CVE-2026-79994

Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

No known exploitation. EPSS puts it in the 3rd percentile. Only a workaround so far.

CVSS —Not scored EPSS percentile3rd0.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-15Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check whether you run Docker Sandboxes and have the guest-to-host Unix-domain socket relay feature configured.
Upgrade Docker Sandboxes to version 0.42.0 or later.
If upgrading is delayed, use --clone mode and avoid additional read-write host mounts.
Review sandbox activity and host-service logs for unexpected connections from sandbox workloads.

Usually a quick update

What it is

From the CVE record

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.

In plain language

Written by AI from the record

Docker Sandboxes before 0.42.0 can let harmful code inside a sandbox reach protected parts of the host computer; act now if you use its guest-to-host socket relay.

CWE-367 time-of-check/time-of-use symlink race in Docker Sandboxes’ guest-to-host Unix-domain socket relay can redirect a validated workspace socket path to an arbitrary host AF_UNIX socket.

If you're affected

Host service access
Sensitive data exposure
Host file modification
Sandbox escape
Operational disruption

What is it

A flaw in the sandbox connection feature can allow a program inside a sandbox to ask the main computer to connect to the wrong local service. It is like a visitor swapping a labeled office door after a guard checks the label, so the visitor is taken somewhere they were not permitted to go.

Who is affected

This matters to you if you run Docker Sandboxes, particularly on macOS, for workloads that may execute untrusted or malicious code. It is only a risk if a Docker Sandbox instance is configured with the guest-to-host Unix-domain socket relay feature.

How urgent is it

A malicious process inside a Docker Sandbox can use this flaw to reach host services or files outside its intended area, so treat this as urgent. There is no reported real-world exploitation or public exploit code, but the potential for sandbox escape and host access warrants a RED response.

What to do — in detail

Confirm exposure by identifying Docker Sandboxes installations and checking their configuration for the guest-to-host Unix-domain socket relay feature. Upgrade to Docker Sandboxes 0.42.0; validate the upgrade in a non-production sandbox first if your workflows depend on host mounts or socket-based integrations.

If patching must wait, use --clone mode and remove or avoid additional read-write host mounts to reduce host exposure. No CISA KEV deadline applies because this CVE is not listed in KEV. Monitor Docker Sandbox use and host-side Unix-socket services for unexpected connections, file changes, or access attempts originating from sandbox workloads.

Technical context

Severity score was not provided in the findings. The issue is CWE-367: a TOCTOU symlink race in the guest-to-host Unix-domain socket relay, where a guest can replace an intermediate path after validation and before the host reconnects, redirecting the connection to an arbitrary AF_UNIX socket. The attack vector is a guest process within Docker Sandbox; user interaction is not required, while authentication requirements are unknown. The feature is reachable in the default configuration when the relay is configured. No exploitation has been reported, CISA does not list it in KEV, and no public exploit code is recorded. EPSS is 0.1% (1st percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS3rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.1% chance of exploitation activity in the next 30 days, which ranks it in the 3rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 1 day, from the signal feeds we watch.

2026-09-16Workaround availableworkaround available, record updated, record updated
2026-09-15Workaround availablepublished, weakness classified, att&ck mapped, record updated