CVE-2026-77179: Docker container escape to the macOS filesystem

Researcher Oren Yomtov of Accomplish discovered CVE-2026-77179 — a sandbox escape in Docker’s hypervisor for Mac that allows code running inside a container to gain complete read and write access to the host filesystem.

The issue lies in virtio-fs, which Docker VMM uses to expose mounted directories to containers. When the guest first accesses a path, the file server returns a nodeid and stores the path. On subsequent requests, the guest refers to the file by nodeid, so the server has to resolve it again. It first tries to locate the file by inode through macOS volfs; if that fails, it falls back to the path string saved during the initial lookup.

The attacker creates and opens a file inside the permitted mount and keeps the handle open, preventing the server from dropping its nodeid. The file and its parent directory are then deleted, removing the volfs path, and the directory is replaced with a symbolic link to an arbitrary location on the host. When virtio-fs falls back to the stored path, its check still sees a path inside the permitted mount, but macOS follows the symlink when opening it and resolves the request outside the mount. This gives the container access to host files. The author demonstrates the escape in just three lines of Bash.

This is not a remote attack on its own: an attacker needs the ability to execute code inside the container. The issue is particularly relevant to AI agents, which routinely execute untrusted code and rely on the sandbox to isolate it from the host system.

The vulnerability was fixed in Docker Sandboxes 0.42.0 and Docker Desktop 4.88.0. Docker Desktop is affected on macOS only when Docker VMM is selected as the Virtual Machine Manager. Docker committed the fix to Sailor, the internal name of its hypervisor, about 31 hours after receiving the report. Docker Desktop 4.88.0 shipped the fix on August 24, and Docker Sandboxes 0.42.0 followed on September 7.

Article: https://www.accomplish.ai/blog/escaping-dockers-hypervisor/