# CVE-2026-12539: Docker Sandboxes ICMP egress block bypass after daemon restart

Source: https://junglewise.ai/threats/cve-2026-12539-docker-sandboxes-icmp-egress-block-bypass-after-daemon-restart  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-12539 · Severity: info · CVSS 5.7 · Published 2026-06-18

Docker Sandboxes, which provide isolated environments for running untrusted code, fail to maintain network restrictions after the Docker service restarts. Specifically, a security rule intended to block outgoing ICMP traffic (often used for network testing) is not reapplied when the system reboots or the service restarts. This could allow an untrusted application inside the sandbox to perform unauthorized network reconnaissance or leak sensitive data to external servers.

Technologies: [Docker Sandboxes](https://junglewise.ai/threats/technologies/sandboxes). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker).

## Quick answers

**Is CVE-2026-12539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12539 being exploited in the wild.

**How severe is CVE-2026-12539?** Informational severity, with a CVSS score of 5.7, published 18 June 2026.

**Which products and versions are affected?** Docker Sandboxes 0.14.0 to 0.33.0.

**Is there a fix for CVE-2026-12539?** A patch was published on 2026-06-17: Version 0.33.0 released fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12539 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-12539?** Check whether you run Docker Sandboxes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Docker Sandboxes (sbx) exists where the ICMP egress authorizer is only applied during initial network creation. When the Docker daemon restarts and rebuilds networks from disk, this specific restriction is not re-initialized for surviving sandboxes. An attacker with local access to a workload inside a sandbox can exploit this state to send ICMP packets to arbitrary hosts, bypassing configured allowlists. This enables network reconnaissance and the establishment of ICMP covert channels for data exfiltration. The issue is addressed in version 0.33.0.

## Affected products

- Docker Docker Sandboxes (sbx) 0.14.0 to 0.33.0

## Timeline

- 2026-06-17: patched: Version 0.33.0 released fixing the issue.
- 2026-06-18: disclosed: CVE published.

## References

- [https://docs.docker.com/ai/sandboxes/](https://docs.docker.com/ai/sandboxes/)
- [https://github.com/docker/sbx-releases/releases/tag/v0.33.0](https://github.com/docker/sbx-releases/releases/tag/v0.33.0)

## Related threats

- [Docker Sandboxes host-port republication after removal](https://junglewise.ai/threats/cve-2026-126330-docker-sandboxes-can-silently-republish-a-sandbox-service-after)
- [Docker Sandboxes privilege escalation via directory ownership](https://junglewise.ai/threats/cve-2026-126329-docker-sandboxes-reuses-existing-state-and-configuration)
- [Docker Sandboxes arbitrary code execution via Git configuration](https://junglewise.ai/threats/cve-2026-121614-docker-sandboxes-versions-0-31-0-before-0-50-0-do-not-neutralize)
- [Docker Sandboxes sbx cp path traversal via symlink](https://junglewise.ai/threats/cve-2026-103916-docker-sandboxes-sbx-cp-does-not-safely-confine-host-side-paths)
- [Docker Sandboxes AF_UNIX socket symlink bypass](https://junglewise.ai/threats/cve-2026-79994-docker-sandboxes-af-unix-socket-symlink-bypass)