CVE-2026-79994

Katalog CVE

CVSS 8.7 · High EPSS 0,14%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition. Skor CVSS 4.0 8.7 (High) menurut docker.com.

Deskripsi (NVD)

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

16 September 2026

Status NVD

Awaiting Analysis

CVSS 4.0

8.7 (High), sumber docker.com
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://docs.docker.com/ai/sandboxes/
• https://docs.docker.com/ai/sandboxes/security/isolation/
• https://github.com/docker/sailor/pull/2021
• https://github.com/docker/sandboxes/pull/5342
• https://github.com/docker/sbx-releases/releases/tag/v0.42.0