Docker Docker Sandboxes
11 CVEs affecting Docker Docker Sandboxes. Latest disclosed: 2026-11-03. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-121614 | | 2026-11-03 | Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attack… | |
CVE-2026-103916 | | 2026-11-03 | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a… | |
CVE-2026-105570 | | 2026-10-08 | Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing tre… | |
CVE-2026-105452 | | 2026-10-08 | Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials o… | |
CVE-2026-101998 | | 2026-10-08 | Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affect… | |
CVE-2026-79994 | | 2026-09-15 | The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the p… | |
CVE-2026-77179 | | 2026-09-15 | On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest… | |
CVE-2026-17106 | | 2026-08-18 | The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations… | |
CVE-2026-18171 | | 2026-08-12 | Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is ad… | |
CVE-2026-12539 | | 2026-06-18 | Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when… | |
CVE-2026-12039 | | 2026-06-18 | Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queri… |