CVE-2026-18171 in Sandboxes
Summary
by MITRE • 08/12/2026
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical security flaw in Docker sandbox implementations where the protection mechanisms fail to properly enforce mount permissions across the host-container boundary. The core issue lies in how Docker Sandboxes handle read-only mount intents, specifically when translating host mount configurations into guest container policies. When a host directory is mounted with read-only intent, the system correctly applies this restriction within the guest container context but fails to maintain the same protection at the underlying virtio-fs host edge. This creates an inconsistent security state where the container filesystem appears read-only from the guest perspective but remains writable from the host side through the shared export path.
The technical flaw stems from improper policy enforcement mechanisms that fail to synchronize access permissions between the host and guest environments. The vulnerability manifests when Docker Sandboxes add the underlying virtio-fs host-edge grant to the sandbox's policy-share allowlist without specifying any access mode constraints, thereby leaving the directory writable at its shared-export path despite the read-only intent established for the guest container. This design flaw creates a privilege escalation vector where unprivileged processes running inside the sandbox can exploit the inconsistency by deriving the shared export path and writing directly to host directories that were intended to be read-only.
The operational impact of this vulnerability is severe as it undermines the fundamental security model of container isolation and sandboxing. Attackers can leverage this flaw to bypass access controls and write arbitrary data to host directories, potentially leading to privilege escalation, data corruption, or even complete system compromise. The vulnerability affects any Docker environment that utilizes sandboxed containers with read-only host mounts, making it particularly concerning for production systems where security isolation is paramount. This issue directly violates the principle of least privilege and can be exploited to gain unauthorized access to sensitive host resources.
Organizations should implement immediate mitigations including disabling read-only mount functionality in sandboxed environments until proper fixes are deployed, implementing additional host-level access controls, and monitoring for unauthorized write operations to previously read-only directories. The vulnerability aligns with CWE-284 Access Control Issues and can be mapped to ATT&CK techniques related to privilege escalation and persistence through container escape methods. Security teams should also consider implementing runtime protection mechanisms that detect and prevent unauthorized write attempts to host directories from within sandboxed containers, while ensuring proper synchronization between host and guest mount permissions to maintain consistent security policies across all system boundaries.