🔴 Critical: Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
-
Docker has disclosed a critical vulnerability in Docker Sandboxes on macOS that allows malicious code running inside the sandboxed virtual machine to break out of the shared project directory and access the wider host filesystem.
According to Docker's security announcement on September 15, code executing inside the sandbox can escape the project directory that is shared into the VM and then read or modify files anywhere else on the host. The escaped code operates with the privileges of the host account that launched the virtual machine, meaning the impact is limited only by what that user account is permitted to do.
The flaw is tracked as CVE-2026-77179 and carries a Critical severity rating. Affected versions were noted in the advisory, so users should check their installed release against Docker's guidance.
Mitigation steps:
- Review Docker's security announcement for the list of affected versions.
- Update Docker Sandboxes to a patched release as soon as one is available.
- Avoid running untrusted or malicious code inside a sandbox on an unpatched installation.
- Where patching is not immediately possible, limit the host privileges of the account used to run the virtual machine and restrict what is shared into the sandbox.
Source: The Hacker News
Are you running Docker Sandboxes on macOS, and have you already checked whether your version is affected?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login