Executive brief
Docker Sandboxes, which provide isolated environments for running untrusted code, fail to maintain network restrictions after the Docker service restarts. Specifically, a security rule intended to block outgoing ICMP traffic (often used for network testing) is not reapplied when the system reboots or the service restarts. This could allow an untrusted application inside the sandbox to perform unauthorized network reconnaissance or leak sensitive data to external servers.
Technical details
A vulnerability in Docker Sandboxes (sbx) exists where the ICMP egress authorizer is only applied during initial network creation. When the Docker daemon restarts and rebuilds networks from disk, this specific restriction is not re-initialized for surviving sandboxes. An attacker with local access to a workload inside a sandbox can exploit this state to send ICMP packets to arbitrary hosts, bypassing configured allowlists. This enables network reconnaissance and the establishment of ICMP covert channels for data exfiltration. The issue is addressed in version 0.33.0.
Affected products
- Docker Docker Sandboxes (sbx) 0.14.0 to 0.33.0
Timeline
- 2026-06-17: patched: Version 0.33.0 released fixing the issue.
- 2026-06-18: disclosed: CVE published.