Docker · Docker Sandboxes · CVE-2026-12039
**Name of the Vulnerable Software and Affected Versions**
Docker Sandboxes (sbx) (affected versions not specified)
**Description**
Docker Sandboxes (sbx) implements an egress allowlist restricted to HTTP/S traffic but fails to apply this restriction to DNS resolution. The embedded DNS server for each network forwards all queries to the host resolver when internet connectivity is active, bypassing the established policy. This allows an untrusted workload within a sandbox to exfiltrate data by encoding it into DNS labels for a domain controlled by an attacker, creating a DNS covert channel. A DNS covert channel is a method of transferring data by hiding it within legitimate DNS query traffic.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.