CVE-2026-79994

Name of the Vulnerable Software and Affected Versions Docker Sandboxes (affected versions not specified)

Description The guest-to-host Unix-domain socket relay in Docker Sandboxes contains a flaw where it validates that a socket path is within an authorized workspace but subsequently reconnects using the pathname. A malicious guest can exploit this by replacing an intermediate directory with a symlink between the validation and connection phases. This allows the host to connect to an arbitrary AF UNIX socket outside the shared workspace, potentially exposing data or host-side capabilities provided by the targeted socket. AF UNIX is a type of local inter-process communication socket.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.