CVE-2026-12539

Name of the Vulnerable Software and Affected Versions Docker Sandboxes (affected versions not specified)

Description Docker Sandboxes (sbx) fail to re-apply the ICMP egress authorizer to networks rebuilt from disk after a Docker daemon restart. This allows a restart-surviving sandbox to forward ICMP traffic to arbitrary hosts, bypassing the documented egress block. An untrusted workload within the sandbox can exploit this to perform network reconnaissance or exfiltrate data via an ICMP covert channel, ignoring the configured allowlist.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.