Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker Sandboxes flaw allows guest code to read/modify macOS host files.
A critical vulnerability in Docker Sandboxes for macOS, CVE-2026-77179, allows malicious code within a virtual machine to escape its project directory and access or alter any file on the host system with the user's privileges. A second high-severity flaw, CVE-2026-79994, enables guests to connect to unauthorized Unix domain sockets on the host. Both issues are fixed in version 0.42.0.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Docker?
Get an email when a new story names Docker, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-77179 reveals a critical container/VM sandbox escape flaw in Docker for macOS, where malicious guest code can break out of its isolated project directory and read or modify any host file accessible to the running user. A companion flaw, CVE-2026-79994, further allows guest processes to connect to unauthorized Unix domain sockets on the host, broadening the attack surface significantly. These vulnerabilities undermine the fundamental security promise of containerization — that guest workloads are isolated from the host. The risk is especially severe in developer environments where Docker often runs with elevated user privileges and access to sensitive files such as SSH keys, credentials, and source code. Both flaws are patched in version 0.42.0, making rapid upgrade essential.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-77179
- cve — CVE-2026-79994