# CVE-2026-77179: Docker Sandboxes virtio-fs symlink escape on macOS

Source: https://junglewise.ai/threats/cve-2026-77179-docker-sandboxes-virtio-fs-symlink-escape-on-macos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77179 · Severity: info · Published 2026-09-15

Docker Sandboxes on macOS uses a virtio-fs file sharing mechanism to allow containers to access files on the host machine. A malicious container can exploit improper symlink handling to bypass sandbox restrictions, gain access to files outside the shared workspace, and potentially execute code on the host computer with the same privileges as the hypervisor process.

Technologies: [Docker Sandboxes](https://junglewise.ai/threats/technologies/sandboxes). Vendors: [Docker](https://junglewise.ai/threats/vendors/docker).

## Quick answers

**Is CVE-2026-77179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77179 being exploited in the wild.

**How severe is CVE-2026-77179?** Informational severity, published 15 September 2026.

**Which products and versions are affected?** Docker Sandboxes.

**Is there a fix for CVE-2026-77179?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77179 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-77179?** Check whether you run Docker Sandboxes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a symlink following bypass in the virtio-fs host server used by Docker Sandboxes on macOS. When reopening a previously unlinked file from a stored path, the server improperly follows symlinks instead of using the original inode reference. An attacker with guest-level access can replace a parent directory with a symlink, causing the file reopening logic to traverse into arbitrary host filesystem locations. This allows reading and modifying arbitrary files accessible to the VMM user, potentially leading to host code execution. The attack requires guest-level access but does not require additional user interaction or network connectivity.

## Affected products

- Docker Sandboxes

## Timeline

- 2026-09-15: disclosed

## References

- [https://docs.docker.com/ai/sandboxes/](https://docs.docker.com/ai/sandboxes/)
- [https://docs.docker.com/ai/sandboxes/security/isolation/](https://docs.docker.com/ai/sandboxes/security/isolation/)

## Related threats

- [Docker Sandboxes host-port republication after removal](https://junglewise.ai/threats/cve-2026-126330-docker-sandboxes-can-silently-republish-a-sandbox-service-after)
- [Docker Sandboxes privilege escalation via directory ownership](https://junglewise.ai/threats/cve-2026-126329-docker-sandboxes-reuses-existing-state-and-configuration)
- [Docker Sandboxes arbitrary code execution via Git configuration](https://junglewise.ai/threats/cve-2026-121614-docker-sandboxes-versions-0-31-0-before-0-50-0-do-not-neutralize)
- [Docker Sandboxes sbx cp path traversal via symlink](https://junglewise.ai/threats/cve-2026-103916-docker-sandboxes-sbx-cp-does-not-safely-confine-host-side-paths)
- [Docker Sandboxes AF_UNIX socket symlink bypass](https://junglewise.ai/threats/cve-2026-79994-docker-sandboxes-af-unix-socket-symlink-bypass)