Docker: CopyEscape Docker Vulnerability Lets Malicious Containers Overwrite Host Files and Gain Root

Critical Docker Vulnerability "CopyEscape" Enables Host File Overwrite and Root Access

A newly disclosed Docker vulnerability, CVE-2026-17106 (dubbed CopyEscape), allows malicious containers to overwrite files on the host system and, in certain configurations, achieve full root-level code execution. Discovered by Imperva’s Red Team, the flaw affects the widely used docker cp command and the sbx cp command in Docker Sandboxes, which are employed in AI-agent workflows.

How the Exploit Works

The vulnerability resides in Docker’s archive pipeline, which handles file transfers between containers and the host. Instead of a direct copy, Docker packages files into a tar archive and extracts them on the host. However, Imperva researchers identified a race condition combined with a flawed symlink check that allows attackers to manipulate this process.

By swapping directories with symlinks mid-scan, a malicious container can trick Docker into writing files outside the intended destination such as /usr/bin bypassing sandbox isolation. The exploit leverages a mismatch between the validated path and the actual symlink target, enabling arbitrary file overwrites.

Impact and Attack Scenarios

• CI/CD Pipelines & Developer Workstations: Since docker cp is commonly used to retrieve logs, build artifacts, and forensic evidence, attackers could exploit it to compromise automation tools or escalate privileges.
• macOS Systems: Docker Desktop extracts files locally, allowing attackers to overwrite shell startup scripts, SSH configs, or LaunchAgents, leading to code execution upon terminal launch.
• Linux Systems: If docker cp runs with elevated privileges, the exploit can replace system binaries (e.g., runc), granting immediate root access.
• AI-Agent Environments: The flaw also affects Docker Sandboxes’ sbx cp, exposing AI workflows to similar risks when retrieving files from untrusted sandboxes.

Patches and Mitigations

Docker has released fixes in:

• Docker Engine & CLI 29.7.2
• Docker Desktop 4.86.0
• Docker Sandboxes 0.38.0

The disclosure process began in April 2026, with multiple extensions required to address regressions from an earlier patch.

Key Takeaway

The vulnerability underscores that archive extraction itself is a security boundary, and traditional path-string checks fail when symlinks and concurrent file changes are involved. Organizations are advised to avoid running docker cp on untrusted or live containers until patched.

Source: https://cybersecuritynews.com/copyescape-docker-vulnerability/

Docker, Inc cybersecurity rating report: https://www.rankiteo.com/company/docker

"id": "DOC1786467288",
"linkid": "docker",
"type": "Vulnerability",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Users of Docker Engine, Docker '
                                              'CLI, Docker Desktop, and Docker '
                                              'Sandboxes',
                        'industry': 'Containerization & Cloud Computing',
                        'location': 'Global',
                        'name': 'Docker',
                        'size': 'Large',
                        'type': 'Technology Company'}],
 'attack_vector': 'Container Escape via `docker cp` or `sbx cp` commands',
 'date_detected': '2026-04',
 'description': 'A newly disclosed Docker vulnerability, CVE-2026-17106 '
                '(dubbed *CopyEscape*), allows malicious containers to '
                'overwrite files on the host system and, in certain '
                'configurations, achieve full root-level code execution. The '
                'flaw affects the widely used `docker cp` command and the `sbx '
                'cp` command in Docker Sandboxes, which are employed in '
                'AI-agent workflows. The vulnerability resides in Docker’s '
                'archive pipeline, which handles file transfers between '
                'containers and the host, and is exploited via a race '
                'condition combined with a flawed symlink check.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'security flaw in widely used '
                                       'containerization tool',
            'operational_impact': 'Privilege escalation, arbitrary file '
                                  'overwrites, potential root access',
            'systems_affected': 'Docker Engine, Docker CLI, Docker Desktop, '
                                'Docker Sandboxes'},
 'investigation_status': 'Disclosed and patched',
 'lessons_learned': 'Archive extraction itself is a security boundary, and '
                    'traditional path-string checks fail when symlinks and '
                    'concurrent file changes are involved.',
 'post_incident_analysis': {'corrective_actions': 'Patches released to address '
                                                  'the vulnerability and '
                                                  'prevent arbitrary file '
                                                  'overwrites',
                            'root_causes': 'Race condition and flawed symlink '
                                           'check in Docker’s archive '
                                           'pipeline'},
 'recommendations': 'Apply patches for Docker Engine & CLI 29.7.2, Docker '
                    'Desktop 4.86.0, and Docker Sandboxes 0.38.0. Avoid '
                    'running `docker cp` on untrusted or live containers until '
                    'patched.',
 'references': [{'source': 'Imperva’s Red Team'}],
 'response': {'containment_measures': 'Patches released for Docker Engine & '
                                      'CLI 29.7.2, Docker Desktop 4.86.0, and '
                                      'Docker Sandboxes 0.38.0',
              'remediation_measures': 'Avoid running `docker cp` on untrusted '
                                      'or live containers until patched',
              'third_party_assistance': 'Imperva’s Red Team (discovery)'},
 'title': "Critical Docker Vulnerability 'CopyEscape' Enables Host File "
          'Overwrite and Root Access',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-17106 (CopyEscape)'}