What is CVE-2026-103916?
CVE-2026-103916 is a high-severity security flaw registered with a CVSS score of 8.4 in Docker Sandboxes sbx cp. Similar to issues found in other components like privilege escalation flaws, understanding sandbox boundaries is vital.
The vulnerability stems from CWE-59, where host-side paths are not safely confined to a shared workspace environment.
Who is affected and how does it happen?
A malicious sandbox can create or replace a workspace symbolic link to manipulate file operations. When a user initiates a copy operation, it reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to an unauthorized host path.
These actions are executed with the permissions of the invoking user, magnifying the impact of potential local attacks.
How do I protect my system?
To mitigate risks associated with CVE-2026-103916, administrators and developers must follow safe operational guidelines. You can consult the security isolation documentation for architectural details or check the official release notes for patches.
Always verify workspace paths before executing copy commands within containerized environments.
- Review all active Docker Sandboxes configurations and shared workspace directories.
- Avoid running untrusted sandbox images that could create unauthorized symbolic links.
- Update your tooling and check the release registry frequently.
- Monitor user-initiated copy operations involving host paths.