CVE-2026-18171: Docker Sandboxes read-only runtime mount writable through its shared-export alias
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18171?
The severity of CVE-2026-18171 is rated at 65.
How does CVE-2026-18171 affect Docker Sandboxes?
CVE-2026-18171 allows a writable directory through its shared-export path despite the read-only intent of the runtime mount.
Who is impacted by CVE-2026-18171?
Users running Docker Sandboxes are impacted by CVE-2026-18171 due to the privilege escalation risk.
How can CVE-2026-18171 be mitigated?
Mitigation for CVE-2026-18171 involves applying proper access controls and avoiding the use of shared-export paths in sensitive contexts.
Is there a fix available for CVE-2026-18171?
As of now, there is no specific fix available for CVE-2026-18171, so users should review their configurations.