Docker CopyEscape Flaw (CVE-2026-17106) Enables Host File Overwrite and Code Execution
Do Son 
TL;DR: Imperva’s Red Team disclosed a Docker CopyEscape vulnerability that turns the ordinary docker cp command into a host file-write primitive. Tracked as CVE-2026-17106, the flaw carries a CVSS score of 7.1 and can lead to code execution on the machine running the Docker CLI. Docker later confirmed the same bug affects sbx cp, the file-copy command used by Docker Sandboxes for AI-agent workflows.
Why It Matters
Developers run docker cp constantly, to pull build artifacts, test results, and logs out of containers. Incident responders use the same command to collect forensic evidence from a container they already suspect is compromised. This Docker CopyEscape vulnerability turns that routine action into an attack surface. A malicious container can overwrite any file writable by the user running the copy, including shell startup scripts, SSH configuration, and persistence locations. On macOS, that can mean code execution the next time the victim opens a terminal. On Linux, if an administrator or CI job runs docker cp with sudo, the same primitive can reach root-owned files, including the runc binary that Docker itself executes moments later. The impact scales with automation, since a CI pipeline that copies artifacts on every build could trigger this write primitive repeatedly, without anyone noticing.
How the Attack Works
CVE-2026-17106 chains two separate weaknesses in Docker’s archive pipeline. First, a container the attacker controls can rename files and swap directories for symlinks while the Docker daemon is still reading its filesystem to build a tar archive. This timing gap lets a directory the daemon already recorded turn into a symlink before the archive finishes. Docker locks the container object while it reads the archive, but that lock protects only Docker’s internal bookkeeping. It does not pause the processes running inside the container, which is what leaves the timing gap open. Second, the Docker CLI’s extractor validates one version of a file path but writes to a different one once it follows that symlink, so its containment check does not match what actually lands on disk. Together, these two gaps let a symlink planted mid-copy point outside the folder the user chose, and let a later archive entry write through that symlink onto the host.
Affected Versions
The flaw affects Docker Engine and CLI before version 29.7.2, and Docker Desktop before 4.86.0. Docker’s go-archive security advisory confirms this fix range for the archive library at the center of the bug. Docker Sandboxes carries the same class of issue through version 0.38.0, released August 6, which Docker’s release notes describe as fixing a destination-escape flaw in sbx cp copy-out. Imperva validated its research against Docker Engine 29.6.1 on Linux and Docker Desktop 4.81.0 on macOS. Docker’s own timeline shows the disclosure process began in April 2026 and needed several extensions after an earlier attempted fix introduced regressions.
Patch and Mitigation Steps
Patching resolves this Docker CopyEscape vulnerability completely. Docker recommends upgrading to Docker Engine and CLI 29.7.2 or later, and Docker Desktop 4.86.0 or later, along with Docker Sandboxes 0.38.0 or later. Teams that cannot patch immediately should stop a container before copying files out of it, since the race used in this exploit needs a running container. Avoid sudo docker cp and other root-run copy automation where possible. Imperva’s write-up puts it plainly: “archive extraction is a security boundary” that string-based path checks alone cannot enforce. For containers already suspected of compromise, retrieve evidence through a disposable account or an isolated VM rather than a production workstation. Public technical analysis and proof-of-concept details for this flaw are already available, so patching should not wait. No source has confirmed active exploitation in the wild.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
