CVE-2026-126330

Docker Sandboxes restores removed automatically assigned port publications

Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-126329

Docker Sandboxes privilege escalation through untrusted state directories

Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-115539

Cluster-API proxy overwrites forwarded client identity with its own

SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Docker Moby

Products

Docker Engine Moby Swarmkit

CVE-2026-115538

Docker Engine overlay-network encryption rules are not restored after a firewalld reload

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Docker Moby

Products

Docker Engine Moby

CVE-2026-123082

Docker Desktop logs can expose the Docker Hub access token

Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Desktop

CVE-2026-121614

Docker Sandboxes host Git executes repository-controlled programs

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-114409

Docker Desktop logs can expose stored third-party credentials

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Desktop

CVE-2026-112917

Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2026-103916

Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-106581

Docker Desktop for Windows installer failed to verify external packages

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Desktop

CVE-2026-102489

Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

CVSS 4.0 · 9.4 Critical EPSS 49.9% KEV · Listed

Vendors

Docker Linux Zammad

Products

Docker Linux Kernel Zammad

CVE-2026-102490

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

CVSS 4.0 · 9.4 Critical EPSS 10.9% KEV · Listed

Vendors

Docker Linux Zammad

Products

Docker Linux Kernel Zammad

CVE-2026-92542

Blind VXLAN injection into encrypted overlay networks from cluster peer

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria: - UDP datagram - Destination port is the Swarm data-path port - Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Docker Moby

Products

Docker Engine Docker Engine Overlay Network Driver Moby Overlay Network Driver

CVE-2026-101998

Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes Sandboxes

CVE-2026-105570

Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes Sandboxes

CVE-2026-105452

Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in another supported authentication header. For affected upstream services, this could authenticate the request to an attacker-controlled account and expose data included in the request.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-92543

Docker Engine insecure-registry fallback via malicious DNS responses

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Docker Moby

Products

Docker Engine Moby

CVE-2026-103433

Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Buildx

CVE-2026-79994

Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes Sandboxes

CVE-2026-77179

Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes