Is CVE-2026-121614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121614 being exploited in the wild.

How severe is CVE-2026-121614?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Docker Sandboxes 0.31.0 before 0.50.0.

Is there a fix for CVE-2026-121614?

Yes: fixed in 0.50.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121614 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-121614?

Check whether you run Docker Sandboxes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121614: Docker Sandboxes arbitrary code execution via Git configuration

CVE-2026-121614 · Severity: info · Published 2026-11-03

Docker Sandboxes is a containerization tool that runs applications in isolated microVMs. Versions 0.31.0 through 0.49.x fail to sanitize Git configuration settings, allowing an attacker with write access to a repository to inject commands that execute on the host with the user's permissions when Git operations occur. This bypasses the sandbox isolation, potentially leading to data theft, system compromise, or lateral movement.

Technologies: Docker Sandboxes. Vendors: Docker.

Quick answers

Is CVE-2026-121614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121614 being exploited in the wild.
How severe is CVE-2026-121614?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Docker Sandboxes 0.31.0 before 0.50.0.
Is there a fix for CVE-2026-121614?: Yes: fixed in 0.50.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121614 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-121614?: Check whether you run Docker Sandboxes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.50.0

Technical details

The vulnerability stems from insufficient neutralization of repository-controlled Git configuration (core.fsmonitor and similar settings) when Docker Sandboxes runs host-side Git commands. An attacker who modifies a repository's Git configuration—either directly in a read-write mounted sandbox or through previous access—can specify an external program to execute. When a clone-mode sandbox initiates a fetch or (in v0.39.0+) a kit push, Git runs the attacker's program on the host outside the microVM isolation with the invoking user's permissions.

Affected products

Docker Sandboxes 0.31.0 before 0.50.0

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.