CVE-2026-18171 Overview
CVE-2026-18171 affects Docker Sandboxes (sbx), where the read-only intent of a runtime host mount is applied only to the in-guest container bind. The underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode enforced. As a result, the directory remains writable at its shared-export path. Unprivileged code inside the sandbox can derive that path and write to a host directory the operator intended to attach read-only. The flaw is classified under CWE-863: Incorrect Authorization and is exploitable locally by code already executing inside the sandbox.
Critical Impact
Sandboxed processes can write to host directories that the operator mounted read-only, breaking a core isolation guarantee of Docker AI Sandboxes.
Affected Products
- Docker Sandboxes (sbx) runtime
- Docker AI Sandboxes leveraging virtio-fs host-edge grants
- Environments using policy-share allowlists for host directory sharing
Discovery Timeline
- 2026-08-12 - CVE-2026-18171 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18171
Vulnerability Analysis
Docker Sandboxes (sbx) exposes host directories to guest containers using virtio-fs. When an operator attaches a host directory with a read-only intent, that intent propagates only to the in-guest bind mount visible to the container process tree. The host-edge grant that authorizes the virtio-fs share is added to the sandbox's policy-share allowlist without an accompanying access mode. This creates an authorization mismatch between the container-facing view and the underlying share.
Because the shared-export path remains writable at the virtio-fs layer, any code inside the sandbox that can enumerate or reconstruct the export path bypasses the read-only guardrail. Operators expecting the read-only flag to enforce integrity on the host directory receive no such guarantee. The impact is host-directory integrity loss without a corresponding confidentiality or availability effect.
Root Cause
The root cause is inconsistent authorization enforcement between two layers of the sandbox share pipeline. The read-only mode is applied to the guest bind but never encoded into the virtio-fs policy-share allowlist entry. Access-mode metadata is dropped at the host edge, leaving the share writable independently of the guest-visible mount configuration.
Attack Vector
Exploitation requires an attacker to already execute unprivileged code inside a Docker sandbox that has at least one read-only host mount configured. The attacker enumerates virtio-fs shared-export paths, derives the writable host-edge path corresponding to the intended read-only mount, and issues write operations directly against that path. No user interaction and no elevated in-guest privileges are required beyond ordinary sandbox execution.
No public proof-of-concept exploit code is available. Refer to the Docker AI Sandboxes Architecture documentation for background on virtio-fs share plumbing.
Detection Methods for CVE-2026-18171
Indicators of Compromise
- Write operations on host directories that were configured as read-only mounts into a Docker sandbox
- Filesystem modification timestamps changing on host paths that the operator did not expect to be mutable
- Sandbox processes issuing writes to virtio-fs shared-export paths outside the guest bind namespace
Detection Strategies
- Audit Docker sandbox configurations for read-only mount declarations and compare against the corresponding virtio-fs policy-share allowlist entries
- Enable host-side filesystem auditing (for example, auditd with -w watches) on directories shared into sandboxes with read-only intent
- Correlate sandbox container identifiers with write events observed on backing host paths to identify mismatches
Monitoring Recommendations
- Monitor virtio-fs daemon logs for write operations targeting shares tagged read-only in operator configuration
- Track file integrity on host directories exposed to any Docker sandbox, regardless of stated mount mode
- Alert on unexpected mutations to configuration, credential, or model files stored in directories mounted read-only into AI sandbox workloads
How to Mitigate CVE-2026-18171
Immediate Actions Required
- Inventory all Docker Sandboxes deployments and enumerate host mounts declared with read-only intent
- Treat any host directory currently shared into a sandbox as effectively writable until the Docker fix is applied
- Restrict sandbox host mounts to directories whose contents can tolerate modification, or copy required data into ephemeral locations before sharing
Patch Information
No fixed version is listed in the NVD entry for CVE-2026-18171 at the time of publication. Consult the Docker AI Sandboxes documentation and Docker security advisories for the vendor-provided patch and upgrade guidance. Apply updates as soon as they become available for the sbx runtime.
Workarounds
- Avoid mounting sensitive host directories into Docker sandboxes until the policy-share allowlist correctly honors the read-only access mode
- Substitute read-only shares with pre-staged, throwaway copies of the required data outside sensitive host paths
- Apply host-level filesystem protections (for example, mounting the underlying host path as read-only at the OS layer) so that virtio-fs cannot write regardless of policy-share configuration
- Reduce the blast radius by running sandboxes under dedicated, least-privileged host user accounts with no write permission to sensitive paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
