Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files

A critical Docker vulnerability (CVE-2026-17106, "CopyEscape") allows a malicious container to manipulate tar archive entries and a race with filesystem scanning so that docker cp (and sbx cp) can be tricked into writing files outside the intended destination on the host; this can overwrite important user files or, if docker cp is run with elevated privileges, replace system binaries (e.g., /usr/bin/runc) and achieve host-level code execution. Imperva produced a proof-of-concept; Docker published patched versions and recommended mitigations such as upgrading to fixed releases, avoiding copying from live untrusted containers, stopping containers before copying, and not running docker cp as root.