CVE-2026-79994 Overview
CVE-2026-79994 is a Time-of-Check Time-of-Use (TOCTOU) vulnerability [CWE-367] in the guest-to-host Unix-domain socket relay used by Docker Sandboxes. The relay validates that a requested socket path resides inside an authorized workspace, then reconnects to that path later using the pathname rather than a stable file descriptor. A malicious guest can swap an intermediate directory for a symbolic link between the validation and connection steps. The host then connects to an arbitrary AF_UNIX socket outside the shared workspace, exposing sensitive data or host-side capabilities reachable through the targeted socket.
Critical Impact
A guest process can escape the workspace boundary and reach arbitrary host Unix sockets, breaking the sandbox isolation model.
Affected Products
- Docker Sandboxes (guest-to-host Unix-domain socket relay)
- Docker sbx-releases prior to v0.42.0
- Docker AI Sandboxes environments using the shared workspace relay
Discovery Timeline
- 2026-09-15 - CVE-2026-79994 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-79994
Vulnerability Analysis
The Docker Sandboxes relay brokers AF_UNIX socket connections between guest workloads and the host. To constrain the guest, the relay verifies that a submitted socket path is contained inside an authorized workspace directory. After that check succeeds, the relay opens the socket by re-resolving the same pathname. The two operations are not atomic and do not share a resolved file handle. A guest with write access to any component of the path can alter the directory tree between the check and the use. The result is a classic Time-of-Check Time-of-Use race that undermines the workspace containment guarantee.
Root Cause
The underlying flaw is a [CWE-367] Time-of-Check Time-of-Use race condition. Validation is performed against the string path, while the subsequent connect() call re-walks the filesystem rather than operating on an already-resolved, verified inode or a pinned directory file descriptor. Because path resolution is repeated, any change to an intermediate directory between the two steps is honored by the kernel.
Attack Vector
An attacker executing code inside a guest sandbox prepares a socket path inside the authorized workspace and submits it to the relay. Once validation succeeds, the guest replaces an intermediate directory component with a symbolic link that points outside the workspace, for example to /run or another host directory hosting sensitive AF_UNIX endpoints. When the relay proceeds to connect(), path resolution follows the symlink and the host process opens a connection to the attacker-selected socket. Depending on the target endpoint, the guest can then read privileged data or invoke host-side capabilities exposed by that socket.
No verified public exploit code is available. Refer to the Docker Sandboxes Pull Request 5342 and the Sailor Pull Request 2021 for the corrective changes.
Detection Methods for CVE-2026-79994
Indicators of Compromise
- Host relay processes establishing AF_UNIX connections to paths outside the declared workspace root.
- Rapid rename(), unlink(), or symlink() syscalls from a guest against directories on the socket path immediately before a relay connect event.
- Relay logs showing successful validation followed by a resolved socket path that differs from the validated path.
Detection Strategies
- Enable auditd or eBPF-based monitoring on the host to correlate the relay's stat() and connect() calls against the same file descriptor and inode.
- Alert when guest processes create symbolic links inside a workspace directory that is also an active relay target.
- Track relay connections to well-known sensitive sockets such as docker.sock, containerd.sock, or systemd control sockets originating from sandbox-associated processes.
Monitoring Recommendations
- Baseline the set of Unix socket paths that Docker Sandboxes legitimately proxies and alert on deviations.
- Forward host syscall telemetry and Docker Sandboxes relay logs to a centralized analytics platform for cross-source correlation.
- Review privileged sockets exposed by the host and confirm none are reachable through workspace paths.
How to Mitigate CVE-2026-79994
Immediate Actions Required
- Upgrade Docker Sandboxes to sbx-releases v0.42.0 or later, which contains the fix.
- Audit running sandboxes for unexpected symbolic links inside workspace directories.
- Restrict which host AF_UNIX sockets are reachable from the filesystem namespace shared with guests.
Patch Information
The vendor fix is delivered through Docker Sandboxes Pull Request 5342 and the companion Sailor Pull Request 2021, and is included in the sbx-releases v0.42.0 release. The patch replaces path-based revalidation with connection logic that operates on a resolved, pinned reference so that intermediate directory changes cannot redirect the target.
Workarounds
- Pause use of the guest-to-host Unix-domain socket relay in untrusted sandbox workloads until upgrading.
- Mount the workspace directory as read-only for the guest where the workflow allows, preventing directory replacement.
- Remove or unmount host AF_UNIX sockets that grant privileged capabilities from any filesystem tree accessible to sandboxes.
See the Docker AI Sandboxes Security Isolation documentation for the recommended isolation configuration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
