Quick answers
- Is CVE-2026-77179 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77179 being exploited in the wild.
- How severe is CVE-2026-77179?
- Informational severity, published 15 September 2026.
- Which products and versions are affected?
- Docker Sandboxes.
- Is there a fix for CVE-2026-77179?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77179 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-77179?
- Check whether you run Docker Sandboxes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a symlink following bypass in the virtio-fs host server used by Docker Sandboxes on macOS. When reopening a previously unlinked file from a stored path, the server improperly follows symlinks instead of using the original inode reference. An attacker with guest-level access can replace a parent directory with a symlink, causing the file reopening logic to traverse into arbitrary host filesystem locations. This allows reading and modifying arbitrary files accessible to the VMM user, potentially leading to host code execution. The attack requires guest-level access but does not require additional user interaction or network connectivity.
Affected products
- Docker Sandboxes
Timeline
- 2026-09-15: disclosed