CVE-2026-18171

Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.

CVSS

No CVSS.

References

Link	Resource
https://docs.docker.com/ai/sandboxes/
https://docs.docker.com/ai/sandboxes/architecture/

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Docker Syboxes (sbx) aplica la intención de solo lectura de un montaje de host en tiempo de ejecución solo a la vinculación del contenedor invitado: la concesión suporacente de virtio-fs en el borde del host se añade a la lista de permitidos de política de compartición del sybox sin modo de acceso. El directorio permanece escribible en su ruta de exportación compartida, por lo que el código sin privilegios dentro del sybox puede derivar esa ruta y escribir en un directorio del host que el operador adjuntó como solo lectura.

Information

Published : 2026-08-12 15:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-18171

Mitre link : CVE-2026-18171

CVE.ORG link : CVE-2026-18171

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-18171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18171", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:01:58.499401Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@docker.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@docker.com", "affectedData": [{"cpes": ["cpe:2.3:a:docker:docker_sandboxes:*:*:*:*:*:*:*:*"], "vendor": "Docker", "product": "Docker Sandboxes", "versions": [{"status": "affected", "version": "0.35.0", "versionType": "semver", "lessThanOrEqual": "0.38.0"}], "platforms": ["MacOS", "Linux", "Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T15:17:32.477", "references": [{"url": "https://docs.docker.com/ai/sandboxes/", "source": "security@docker.com"}, {"url": "https://docs.docker.com/ai/sandboxes/architecture/", "source": "security@docker.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@docker.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only."}, {"lang": "es", "value": "Docker Syboxes (sbx) aplica la intenci\u00f3n de solo lectura de un montaje de host en tiempo de ejecuci\u00f3n solo a la vinculaci\u00f3n del contenedor invitado: la concesi\u00f3n suporacente de virtio-fs en el borde del host se a\u00f1ade a la lista de permitidos de pol\u00edtica de compartici\u00f3n del sybox sin modo de acceso. El directorio permanece escribible en su ruta de exportaci\u00f3n compartida, por lo que el c\u00f3digo sin privilegios dentro del sybox puede derivar esa ruta y escribir en un directorio del host que el operador adjunt\u00f3 como solo lectura."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "security@docker.com"}