Docker CopyEscape: TOCTOU Race + Symlink Path Traversal in docker cp Archive Extraction

CVE-2026-17106, dubbed CopyEscape, is a path-traversal and TOCTOU race condition in Docker's docker cp (and sbx cp) archive pipeline. When copying files from a container to the host, the Docker daemon walks the container filesystem, tars it up, and streams it to the CLI for local extraction. A malicious container can race the daemon's directory walk — swapping a directory for an absolute symlink between the WalkDir stat and the Lstat tar-header creation — causing the archive to contain a symlink entry followed by child entries that, upon extraction, land *outside* the user-chosen destination. The CLI's path-validation uses a lexical string check on a *constructed* path but then hands the *original, attacker-controlled* hdr.Linkname to os.Symlink, so the kernel resolves it to an arbitrary host location. Affected: Docker Engine/CLI < 29.7.2, Docker Desktop < 4.86.0, Docker Sandboxes < 0.38.0 (library root: moby/go-archive < 0.3.0). The container must be running for the race to fire.

The GitHub Security Advisory (GHSA-hfg8-hc9c-6c3h) rates this High / CVSS 4.0 7.1, which is honest. The attack *does* require user interaction — someone or something must invoke docker cp against a live, attacker-controlled container — and it *does* require winning a race. But Imperva's PoC shows the race is reliable: you plant a large file before the pivot directory, monitor inotify, and trigger the swap deterministically. On Linux with sudo docker cp the chain ends at root-level arbitrary file write (demonstrated by replacing /usr/bin/runc). On macOS developer boxes it drops LaunchAgent persistence. On CI/CD runners that extract build artifacts via docker cp, it's a supply-chain pivot. The 7.1 score captures the technical friction; it undersells the blast radius on high-value hosts.

Why this verdict

• User interaction is real friction: The attack requires someone or something to run docker cp against a live, attacker-controlled container — this is not a listen-and-exploit network vuln. This caps the score below CRITICAL for most deployment roles.
• Race condition is reliable but not free: Imperva's PoC demonstrates a deterministic win using inotify + large-file timing, but it still requires the container to be running and the attacker to have planted the shim. Read-only containers (--read-only) kill the chain entirely.
• Role multiplier — CI/CD build runners: CI pipelines routinely pull third-party images and extract artifacts with docker cp. A malicious image in this context achieves arbitrary file write on the build host → build artifact poisoning → supply-chain compromise. CI runners are in the high-value role catalog. This floors the verdict at HIGH.
• Role multiplier — AI-agent sandboxes: Docker Sandboxes (sbx cp) are explicitly affected. AI-agent workflows that copy files between sandbox and host are a growing attack surface with weak trust boundaries.
• Developer workstations are medium-value: Overwriting ~/.bashrc, ~/.ssh/authorized_keys, or LaunchAgent plists yields persistent access to a developer's machine — valuable for lateral movement but not fleet-scale.

Why not higher?

CRITICAL would require either unauthenticated remote exploitation or a canonical high-value-role component where ≥10% of installs are the high-value role *by definition*. Docker Engine is broadly deployed, but docker cp usage against untrusted containers is a subset behavior, not the default operating mode. The mandatory user interaction (UI:A) and attack prerequisites (AT:P) mean this cannot be triggered by a drive-by network scan. No in-the-wild exploitation or KEV listing further argues against CRITICAL.

Why not lower?

MEDIUM would ignore the CI/CD and AI-sandbox blast radius. In environments where docker cp is wired into automated pipelines pulling external images, the chain is essentially automated — the 'user interaction' is a cron job, not a human clicking. The Imperva writeup provides weaponization-grade detail, and Docker's 86% market share means the affected population is enormous. The floor rule for supply-chain-pivot outcomes on CI/CD infrastructure keeps this at HIGH.

1. Stop containers before copying files — The TOCTOU race requires a running container to swap the directory for a symlink. Running docker stop <cid> && docker cp <cid>:/path /dest eliminates the race entirely. Deploy this as a wrapper or CI pipeline policy within the noisgate mitigation SLA of 30 days.
2. Use --read-only for untrusted containers — A read-only root filesystem (docker run --read-only) prevents the in-container shim from replacing directories with symlinks. Apply to all CI job containers and sandbox workloads.
3. Drop sudo from docker cp invocations — Running docker cp as a non-root user limits the file-write blast radius to user-writable paths, preventing the demonstrated /usr/bin/runc overwrite that yields root. Audit CI runner configurations for sudo docker usage.
4. Enforce image signing and registry allowlisting — Docker Content Trust or cosign/Sigstore verification prevents unsigned or untrusted images from being pulled into CI pipelines, blocking the primary supply-chain entry vector.
5. Enable file-integrity monitoring on CI runners — Deploy AIDE, osquery file_events, or equivalent FIM on build hosts to detect unexpected writes to system binaries, shell configs, and build artifact directories. This provides detection-in-depth while patching is rolled out.

Run this on any host where Docker Engine/CLI is installed. Execute as the user who normally runs docker commands. Example: bash check_copyescape.sh

#!/usr/bin/env bash
# check_copyescape.sh — Detect CVE-2026-17106 (CopyEscape) exposure
# Run on any Docker host. No elevated privileges required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PATCHED_ENGINE="29.7.2"
PATCHED_DESKTOP="4.86.0"

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# --- Check Docker CLI/Engine version ---
if ! command -v docker &>/dev/null; then
  echo "UNKNOWN — docker command not found on this host."
  exit 2
fi

RAW_VERSION=$(docker version --format '{{.Client.Version}}' 2>/dev/null || true)
if [ -z "$RAW_VERSION" ]; then
  echo "UNKNOWN — could not determine Docker CLI version."
  exit 2
fi

# Strip leading 'v' if present
CLI_VERSION="${RAW_VERSION#v}"

echo "Detected Docker CLI version: $CLI_VERSION"
echo "Patched version: >= $PATCHED_ENGINE"

if version_gte "$CLI_VERSION" "$PATCHED_ENGINE"; then
  echo "PATCHED — Docker CLI $CLI_VERSION is >= $PATCHED_ENGINE. CVE-2026-17106 is fixed."
  exit 0
else
  echo "VULNERABLE — Docker CLI $CLI_VERSION is below $PATCHED_ENGINE. CVE-2026-17106 applies."
  echo "Upgrade Docker Engine/CLI to >= $PATCHED_ENGINE or Docker Desktop to >= $PATCHED_DESKTOP."
  exit 1
fi

Sources

1. Imperva — CopyEscape: Taking Over Docker Hosts with docker cp
2. GHSA-hfg8-hc9c-6c3h — moby/go-archive Advisory
3. GBHackers — Docker CopyEscape Vulnerability
4. CyberSecurity News — CopyEscape Docker Vulnerability
5. Moby/Moby Releases (v29.7.2)
6. Docker CLI PR #7139 — go-archive v0.3.0 vendor update
7. NHS England — Docker Security Updates for Copy Functionality
8. CyberPress — CopyEscape Docker Flaw