# CVE-2026-79994

Container escape via symlink race enabling host AF_UNIX socket access

- Page: https://www.vulneraibility.com/cve/CVE-2026-79994
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.14% (percentile 3.3)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-16)
- Weakness: CWE-367
- Published: 2026-09-15

## Affected versions

- Docker Docker Sandboxes: affected >= 0.37.0 and < 0.42.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Malicious guest can trick host into connecting to arbitrary AF_UNIX sockets outside workspace, exposing data or host-side capabilities and enabling privilege/credential access.

## Action

Immediate action required

## Recommendation

Upgrade to sbx-releases v0.42.0+ and restrict/monitor AF_UNIX sockets

## References

- [other] https://docs.docker.com/ai/sandboxes/
- [other] https://docs.docker.com/ai/sandboxes/security/isolation/
- [patch] https://github.com/docker/sailor/pull/2021
- [patch] https://github.com/docker/sandboxes/pull/5342
- [other] https://github.com/docker/sbx-releases/releases/tag/v0.42.0

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.