{"id":"CVE-2026-103916","kind":"vulnerability","aliases":["CVE-2026-103916"],"related":[],"title":"Docker Sandboxes sbx cp lets a sandbox escape its shared workspace","description":"Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.","summary":"Docker Sandboxes' sbx cp command does not keep host-side paths confined to the shared workspace. A malicious sandbox can plant a symlink so a later user-initiated copy reads or writes host files outside the workspace, using the invoking user's permissions.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Docker Sandboxes (sbx)","fixed":["0.51.0"],"affected":">= 0.28.0, < 0.51.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["docker","docker-sandboxes","other","sbx"],"not_affected_if":["sbx-cp-unused"],"how_to_check":"- Run `sbx version`; versions from 0.28.0 up to but not including 0.51.0 are in the affected range reported in the CVE record (as relayed by hol.org; Docker's release notes do not name the CVE).\n- Only matters if you run `sbx cp` against a sandbox you do not fully trust. Before upgrading, avoid `sbx cp` on sandboxes that may be compromised and check the workspace for unexpected symlinks pointing outside it.","fix":"Upgrade Docker Sandboxes (sbx) to 0.51.0 or later; 0.51.0 release notes: 'sbx cp blocks symbolic links in mounted directories from escaping onto other host paths.'","status":"open","published_at":"2026-11-03T17:17:52+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:00+00:00","updated_at":"2026-11-03T17:28:08+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T17:24:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Docker Sandboxes sbx cp lets a sandbox escape its shared workspace","impact":"high","summary":"Docker Sandboxes' sbx cp command does not keep host-side paths confined to the shared workspace. A malicious sandbox can plant a symlink so a later user-initiated copy reads or writes host files outside the workspace, using the invoking user's permissions.","audience":"developers","category":"other","nicknames":[],"who_cares":["docker-sandboxes","sbx","docker"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Host files outside the workspace are read or overwritten with user permissions","analyst_note":"Confirm affected and fixed Docker Sandboxes versions from the linked release notes (github.com) and the vendor advisory.","how_to_check":"- Run `sbx version` to see the installed Docker Sandboxes version.\n- Check whether the installed version is listed as affected in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-103916).","plain_action":"","needs_analyst":true,"not_affected_if":["sbx-cp-unused"],"who_is_affected":"Teams that run Docker Sandboxes and use sbx cp to move files between a sandbox and the host. The risk needs a sandbox that is malicious or compromised and a later user-initiated copy against its workspace. Teams not using Docker Sandboxes or sbx cp are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4144,"output_tokens":563,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected and fixed Docker Sandboxes versions from the linked release notes (github.com) and the vendor advisory.","search":"'-103916':14A,17A '-2026':13A,16A 'command':31B 'confin':39B,79C 'control':120C 'copi':57B,105C 'cp':4A,30B,75C 'creat':92C 'cve':12A,15A 'data':121C 'docker':1A,18A,21B,23B,27B,72C 'docker-sandbox':22B 'escap':8A 'file':62B,109C 'host':36B,61B,81C,108C,124C 'host-sid':35B,80C 'initi':56B,104C 'invok':68B,131C 'keep':34B 'later':53B,101C 'let':5A 'malici':45B,89C 'outsid':63B,110C,126C 'path':38B,83C,125C 'permiss':71B,134C 'plant':48B 'read':58B,106C 'replac':94C 'safe':78C 'sandbox':2A,7A,24B,28B,46B,73C,90C,115C,119C 'sandbox-control':118C 'sandboxes':19A 'sbx':3A,20A,26B,29B,74C 'share':10A,42B,86C 'side':37B,82C 'symlink':50B,97C 'use':66B 'user':55B,69B,103C,132C 'user-initi':54B,102C 'workspac':11A,43B,65B,87C,96C,112C,128C 'write':60B,117C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Docker Sandboxes and use sbx cp to move files between a sandbox and the host. The risk needs a sandbox that is malicious or compromised and a later user-initiated copy against its workspace. Teams not using Docker Sandboxes or sbx cp are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["dockersandboxessbx","sandboxessbx"],"ptokens":["docker","sandboxes","sbx"],"labels":["docker","dockersandboxes","high","other","sbx"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@docker.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103916","severity":null,"published_at":"2026-11-03T17:17:52+00:00","modified_at":"2026-11-03T17:17:52+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103916:1518","url":null,"severity":null,"published_at":"2026-11-03T17:28:08+00:00","modified_at":"2026-11-03T17:28:08+00:00","first_seen_at":"2026-11-03T17:28:08+00:00","fetched_at":"2026-11-03T17:28:08+00:00","note":"Fix 0.51.0 confirmed in Docker release notes (sbx cp symlink item, released 3 Nov) but notes do not cite the CVE; affected range >=0.28.0 <0.51.0 comes from CVE record via hol.org rewrite, so nothing marked verified. v0.50.0 partly hardened sbx cp (alternate host path symlinks) but is not the fix. No exploitation or PoC found; no social search done."}],"documents":[{"id":59247,"url":"https://github.com/docker/sbx-releases/releases/tag/v0.51.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}