CVE-2026-17106 Overview
CVE-2026-17106 is a path traversal vulnerability in the tar extraction routines of moby/go-archive, the archive-handling library used by Docker Engine, Docker CLI, Docker Compose, and Docker Desktop. The affected functions include Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. The extractor selects destination paths using lexical string checks, then performs filesystem operations on paths resolved by the operating system. Symbolic links introduced by an archive can redirect writes outside the intended destination directory. An attacker who controls archive contents can create or overwrite files at any path writable by the extracting process. The weakness is classified as [CWE-59] Improper Link Resolution Before File Access.
Critical Impact
Attackers who supply a malicious tar archive can write arbitrary files on the host outside the extraction directory, enabling privilege escalation or container escape when Docker components run with elevated permissions.
Affected Products
- Docker Engine versions before 29.7.0
- Docker Desktop versions before 4.86.0 and related components (Docker CLI before v29.7.0, Docker Compose before v5.4.0, Docker SBX before v0.38.0)
- moby/go-archive versions before v0.3.0
Discovery Timeline
- 2026-08-18 - CVE-2026-17106 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-17106
Vulnerability Analysis
The moby/go-archive extractor processes each tar entry by joining the entry name with the destination directory and checking the resulting string against the destination prefix. This lexical validation does not account for symbolic links already present on disk or created earlier in the same archive. When the extractor subsequently calls filesystem primitives such as open or mkdir, the kernel resolves any intermediate symlinks and redirects the operation to an attacker-chosen location.
A crafted archive can therefore include a symlink entry pointing outside the destination, followed by a regular file entry whose path traverses that symlink. The lexical check passes because the joined path still appears to be inside the destination directory, but the OS follows the link and writes to the target. The exploitation pattern matches classic time-of-check to time-of-use handling errors in tar extractors.
Root Cause
The root cause is reliance on string-based path containment checks instead of resolving paths against the destination using symlink-safe primitives such as openat2 with RESOLVE_BENEATH or equivalent chroot-style operations. The extractor also processes symlink entries before applying subsequent file entries that depend on their targets.
Attack Vector
Exploitation requires local access with user interaction, such as convincing a user or automated pipeline to extract, load, or import a malicious image layer, docker save archive, docker build context, or docker cp payload. Because Docker Engine typically runs as root, successful exploitation grants file write primitives at root-owned paths on the host. A public proof-of-concept named CopyEscape demonstrates the technique.
The vulnerability manifests during tar entry processing when the extractor honors symlink entries and then writes through them. See the GitHub Security Advisory GHSA-hfg8-hc9c-6c3h for the technical write-up.
Detection Methods for CVE-2026-17106
Indicators of Compromise
- Unexpected file writes by dockerd, containerd, or docker processes to paths outside /var/lib/docker such as /etc, /root/.ssh, or /usr/local/bin.
- Tar archives, image layers, or build contexts containing symlink entries whose targets use .. sequences or absolute paths pointing outside the extraction directory.
- New or modified SUID binaries, cron entries, or authorized_keys files created shortly after a docker load, docker pull, docker build, or docker cp operation.
Detection Strategies
- Inspect image layers and archives with tar -tvf before extraction and flag any entries whose link targets escape the destination.
- Enable Docker daemon audit logging and correlate image pull, image load, and container cp events with host file modifications outside Docker storage roots.
- Deploy file integrity monitoring on sensitive host paths to detect writes originating from container runtime processes.
Monitoring Recommendations
- Alert on process ancestry where dockerd or containerd writes to /etc, /root, /home, or system binary directories.
- Track use of untrusted registries and public images in CI pipelines, and treat any layer containing symlinks with .. components as suspicious.
- Monitor Docker Engine versions across the fleet and flag hosts running versions earlier than 29.7.0.
How to Mitigate CVE-2026-17106
Immediate Actions Required
- Upgrade Docker Engine to version 29.7.0 or later and Docker Desktop to 4.86.0 or later on all systems.
- Update moby/go-archive to v0.3.0 or later in any Go project that vendors the library directly.
- Refresh Docker CLI to v29.7.0, Docker Compose to v5.4.0, and Docker SBX to v0.38.0 to align dependent components.
- Restrict image sources to trusted registries and disable automatic image pulls from untrusted locations until patched.
Patch Information
The fix ships in moby/go-archive v0.3.0, which replaces lexical path checks with symlink-safe resolution during tar extraction. Distributions are published through the Docker Engine 29.7.0 release notes and the Docker Desktop 4.86.0 release notes. See the Docker CLI v29.7.0 release and Docker Compose v5.4.0 release for downstream updates.
Workarounds
- Avoid loading, importing, or extracting Docker images and archives from untrusted sources until all components are upgraded.
- Run Docker Engine under a user namespace remap so root inside the runtime maps to an unprivileged host user, limiting arbitrary write impact.
- Scan tar archives for symlink entries with escaping targets before extraction and reject any that fail validation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
