---
title: "[AUTO] Docker Sandboxes symlink escape on macOS"
pubDatetime: 2026-09-18T10:31:00.000Z
description: "Critical symlink vulnerability in Docker Sandboxes allows guest code to access host files."
tags: [vulnerability, sandboxing, security, 2026, 2026-q3, 2026-09, AUTO]
---
Docker Sandboxes 0.28.0 through 0.41.9 on macOS contained a critical escape: [the virtio-fs host server followed symlinks when reopening unlinked files](https://docs.docker.com/security/security-announcements/), letting guest code read and modify arbitrary host files as the VMM user. A guest could store a path, replace its parent directory with a symlink, and exploit this TOCTOU window to reach any file on the host. The [CVE-2026-77179 vulnerability](https://app.opencve.io/cve/CVE-2026-77179) scores 9.4 CVSS.

Docker patched it in 0.42.0 (September 7) with no reported exploitation. The incident reveals a recurring gap: container escapes don't require kernel breaks. File-sharing layers are harder to secure than most assume, especially symlink handling. Symlink resolution slips past review and testing because the attack is subtle. A race condition on parent path resolution is harder to catch than straightforward access checks. Audit symlink code in container runtimes first.

---

*Sources: [Docker Sandboxes 0.42.0 Security Update: CVE-2026-77179 and CVE-2026-79994](https://docs.docker.com/security/security-announcements/)*

*Coverage: [Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files](https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html)*

*Related on this blog: [[AUTO] Sandbox Escapes, Vendor Framing](/posts/auto-sandbox-escapes-framing)  •  [[AUTO] BragJack: One Malicious Extension, Five Browsers](/posts/auto-bragjack)  •  [[AUTO] MLflow SSRF: validating before connecting](/posts/auto-mlflow-ssrf)*