# CVE-2026-12039: Docker Sandboxes DNS-based egress policy bypass

Source: https://junglewise.ai/threats/cve-2026-12039-docker-sandboxes-dns-based-egress-policy-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-12039 · Severity: info · CVSS 5.7 · Published 2026-06-18

Docker Sandboxes (sbx) is a tool used to run untrusted code in isolated environments with restricted network access. A flaw in how these sandboxes handle DNS requests allowed untrusted code to bypass security rules and send data to external servers. This could lead to sensitive information being leaked from the sandbox even when strict internet restrictions are in place.

Technologies: [Docker Sandboxes (sbx)](https://junglewise.ai/threats/technologies/sandboxes). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker).

## Quick answers

**Is CVE-2026-12039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12039 being exploited in the wild.

**How severe is CVE-2026-12039?** Informational severity, with a CVSS score of 5.7, published 18 June 2026.

**Which products and versions are affected?** Docker Sandboxes (sbx) 0.13.0 to 0.33.0.

**Is there a fix for CVE-2026-12039?** A patch was published on 2026-06-17: Version 0.33.0 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12039 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-12039?** Check whether you run Docker Sandboxes (sbx) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Docker Sandboxes (sbx) versions 0.13.0 through 0.32.x contain a vulnerability where the per-network embedded DNS server does not consult the configured egress policy. While the sandbox enforces an HTTP/S-only allowlist for direct traffic, it blindly forwards all DNS queries to the host resolver if the network is internet-connected. An attacker with the ability to run code inside a sandbox can encode sensitive data into DNS labels (e.g., data.attacker.com) to exfiltrate information through a DNS covert channel. This bypasses the intended network isolation. The issue is resolved in version 0.33.0, which gates DNS resolution on the network policy.

## Affected products

- Docker Docker Sandboxes (sbx) 0.13.0 to 0.33.0

## Timeline

- 2026-06-17: patched: Version 0.33.0 released with fix.
- 2026-06-18: disclosed: CVE-2026-12039 published.

## References

- [https://docs.docker.com/ai/sandboxes/](https://docs.docker.com/ai/sandboxes/)
- [https://github.com/docker/sbx-releases/releases/tag/v0.33.0](https://github.com/docker/sbx-releases/releases/tag/v0.33.0)