Docker Sandboxes Vulnerabilities: Critical Flaws

Docker published an advisory for two vulnerabilities in Docker Sandboxes (CVE-2026-77179 — Critical macOS virtio-fs symlink/TOCTOU allowing potential sandbox escape and host file access/possible code execution; CVE-2026-79994 — High unix-socket TOCTOU enabling unauthorized AF_UNIX connections). Both issues affect Sandboxes versions prior to 0.42.0 and were fixed in 0.42.0 (released Sept 7, 2026); Docker recommends upgrading, using clone mode if immediate upgrade is not possible, minimizing read-write host mounts, and auditing untrusted workloads.