On macOS

CVE-2026-77179 is a TOCTOU (time-of-check-to-time-of-use) symlink-following flaw in the virtio-fs host server used by Docker Sandboxes on macOS only. Docker Sandboxes (versions 0.28.0 through < 0.42.0) are microVM-backed isolation environments designed to safely run untrusted AI coding agents — Claude Code, Copilot CLI, Codex, OpenCode, Kiro, and similar tools. The virtio-fs host server validates that a file path belongs to an approved shared workspace, but when it later reopens an unlinked file from a stored path, it follows symlinks without re-validating. A malicious guest can race the host by replacing a parent directory with a symlink between the check and the use, redirecting file operations outside the workspace to arbitrary host files readable and writable by the VMM user. The CVSS 4.0 vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H with a score of 9.4. A companion vulnerability, CVE-2026-79994, targets the Unix domain socket relay with an identical TOCTOU pattern and was patched in the same release.

There is no official vendor/NVD CVSS baseline to compare against — multiple third-party trackers cite 9.4, but this appears to be a CVSSv4 score without official NVD confirmation. The 9.4 figure reflects worst-case theoretical impact (full C/I/A on host and subsequent systems) but does not account for real-world deployment constraints: macOS-only, new product with ~6 months of availability, and the attacker must already be executing code *inside* the sandbox. The vulnerability is genuinely serious because it defeats the core security promise of the product — isolating untrusted code from the host. However, the population of affected deployments is far smaller than a typical Docker Engine or Docker Desktop CVE. noisgate assesses this at HIGH (7.5), not CRITICAL, primarily because the installed base is narrow and the attack surface is a developer workstation, not a production server fleet.

Why this verdict

• Sandbox escape defeats core security promise: The product exists to isolate untrusted AI-agent code from the host. This CVE breaks that contract entirely — the attacker scenario (malicious code in the sandbox) is *exactly* the threat model the product is supposed to handle. A sandbox escape in an isolation product is categorically more severe than a similar bug in general-purpose software.
• Role multiplier — developer workstation as supply-chain pivot: Docker Sandboxes run on developer macOS machines. A successful escape yields the developer's SSH keys, Git tokens, cloud credentials, and potentially code-signing material. In organizations using AI coding agents, these are senior developers with broad repo access. The blast radius extends from host → developer identity → source repos → CI/CD → production. This is a supply-chain-class outcome, but it requires a human-in-the-loop (the developer must run untrusted code) and the downstream pivot depends on credential hygiene. The floor for supply-chain-class outcomes in a product *designed for this role* is HIGH.
• Narrow installed base caps severity below CRITICAL: Docker Sandboxes GA'd in March 2026 and is macOS-only. Even with Docker's 92% developer adoption, Sandboxes is an opt-in feature for AI agent workflows — a small fraction of Docker Desktop users. The population of vulnerable hosts in a typical 10,000-host enterprise is likely in the single digits to low dozens. This is not a fleet-scale exposure.
• No PoC, no exploitation, low EPSS: With an EPSS of 0.0016 and no public exploit code, the near-term weaponization risk is low. The TOCTOU race is conceptually simple but requires reverse-engineering the virtio-fs stored-path mechanism. Exploitation complexity is moderate in practice despite CVSS rating it as low.
• macOS-only eliminates server and CI/CD tiers: Linux CI runners, Kubernetes nodes, and production servers are unaffected. The entire exposure surface is macOS developer laptops — a population that typically has stronger endpoint security (EDR, MDM, disk encryption) than average.

Why not higher?

CRITICAL would require either a larger installed base or a canonical high-value role. Docker Sandboxes is a 6-month-old opt-in macOS feature, not a ubiquitous infrastructure component like Docker Engine or containerd. The supply-chain pivot requires multiple additional steps (credential presence, downstream access, no MFA), and the affected population in any enterprise is small. There is no active exploitation, no PoC, and the EPSS is in the bottom decile.

Why not lower?

MEDIUM would undercount the severity of a sandbox escape in an isolation product running untrusted code — this is the *exact failure mode* the product is designed to prevent. The impact on a compromised host is full file read/write as the developer user, which in practice means credential theft and supply-chain access. The TOCTOU race pattern is well-understood and reliably exploitable with retry loops. The patch-first disclosure timeline suggests the vendor considered this serious enough to warrant expedited fixing.

1. Update Docker Sandboxes to 0.42.0 immediately — The patch was released 2026-09-07, eleven days ago. This is the definitive fix. Push the update via MDM (Jamf, Kandji, Mosyle) or internal update channels. Under the noisgate mitigation SLA for HIGH, deploy within 30 days — but given this is a single binary update, aim for this week.
2. Audit and restrict AI agent code sources — Until patched, limit Docker Sandboxes to trusted, vetted repositories only. Block agents from cloning arbitrary public repos or executing unreviewed code. This reduces the likelihood of malicious code entering the sandbox.
3. Revoke and rotate developer credentials stored on disk — SSH keys, Git tokens, cloud credentials (~/.aws, ~/.kube, ~/.azure), and API keys stored in the home directory are the primary exfiltration targets. Rotate these for any developer who ran vulnerable versions with untrusted code. Move to short-lived OIDC-based credentials where possible.
4. Enable macOS endpoint detection on sandbox workspace directories — Configure EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) to alert on symlink creation within Docker Sandbox workspace paths. This provides post-exploitation detection while patching rolls out.
5. Disable Docker Sandboxes on unpatched hosts — If rapid patching is not feasible, disable the Sandboxes feature entirely via MDM configuration profile or Docker Desktop settings. Developers can use standard Docker containers (which have a different, non-virtio-fs isolation model) as a temporary alternative.

Run this on each macOS developer workstation where Docker Desktop with Sandboxes may be installed. Execute as the logged-in user (no root required). Example: bash check_cve_2026_77179.sh

#!/usr/bin/env bash
# check_cve_2026_77179.sh — Detect CVE-2026-77179 (Docker Sandboxes virtio-fs symlink escape)
# Target: macOS hosts with Docker Desktop / Docker Sandboxes
# Privileges: none (runs as current user)
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

# Only relevant on macOS
if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "NOT_APPLICABLE — this CVE only affects macOS"
  exit 0
fi

# Check if docker CLI exists
if ! command -v docker &>/dev/null; then
  echo "UNKNOWN — docker CLI not found on this host"
  exit 1
fi

# Check if docker sandbox subcommand exists
if ! docker sandbox version &>/dev/null 2>&1; then
  # Try alternate detection via Docker Desktop app bundle
  if [[ -d "/Applications/Docker.app" ]]; then
    echo "UNKNOWN — Docker Desktop installed but 'docker sandbox' command not available (Sandboxes may not be enabled)"
    exit 1
  else
    echo "NOT_APPLICABLE — Docker Sandboxes not installed"
    exit 0
  fi
fi

# Get sandbox version
SANDBOX_VERSION=$(docker sandbox version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "${SANDBOX_VERSION}" ]]; then
  echo "UNKNOWN — could not parse Docker Sandboxes version"
  exit 1
fi

echo "Detected Docker Sandboxes version: ${SANDBOX_VERSION}"

# Compare versions: vulnerable range is >= 0.28.0 and < 0.42.0
# Simple numeric comparison using sort -V
MIN_VULN="0.28.0"
FIXED="0.42.0"

version_gte() {
  # Returns 0 if $1 >= $2
  [[ "$(printf '%s\n%s' "$2" "$1" | sort -V | head -1)" == "$2" ]]
}

if version_gte "${SANDBOX_VERSION}" "${FIXED}"; then
  echo "PATCHED — Docker Sandboxes ${SANDBOX_VERSION} >= ${FIXED}"
  exit 0
elif version_gte "${SANDBOX_VERSION}" "${MIN_VULN}"; then
  echo "VULNERABLE — Docker Sandboxes ${SANDBOX_VERSION} is in affected range (${MIN_VULN} to <${FIXED})"
  echo "Action: Update to Docker Sandboxes >= ${FIXED}"
  exit 2
else
  echo "PATCHED — Docker Sandboxes ${SANDBOX_VERSION} < ${MIN_VULN} (pre-dates vulnerable code)"
  exit 0
fi

Sources

1. CyberSecurityNews — Critical Docker Sandbox Vulnerabilities
2. GBHackers — Docker Sandboxes Vulnerabilities Let Malicious Guests Escape
3. SecurityOnline — Docker Sandboxes Vulnerabilities Patched
4. Strix.ai — CVE-2026-77179 Detail
5. Docker — Why MicroVMs: Architecture Behind Docker Sandboxes
6. Docker — Sandboxes Product Page
7. OffSeq Threat Radar — CVE-2026-77179