Docker Sandboxes up to 0.32.x communication channel to intended endpoints

Summaryinfo

A vulnerability was found in Docker Sandboxes up to 0.32.x. It has been classified as problematic. Impacted is an unknown function. This manipulation causes communication channel to intended endpoints. This vulnerability appears as CVE-2026-12539. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Docker Sandboxes up to 0.32.x. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a communication channel to intended endpoints vulnerability. The CWE definition for the vulnerability is CWE-923. The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. As an impact it is known to affect confidentiality. The summary by CVE is:

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlist.

It is possible to read the advisory at docs.docker.com. This vulnerability is known as CVE-2026-12539 since 06/17/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.33.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37893). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Docker

Name

• Sandboxes

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion