Docker cp Vulnerability Enables Container Escape and Host Takeover (CVE-2026-17106)
jedisct1 · x · 2026-08-11
Imperva Threat Research uncovered CVE-2026-17106 (CopyEscape), a severe container-to-host arbitrary file-write vulnerability in Docker's docker cp command.
A malicious container could exploit the file copy process to create or overwrite files outside the intended destination on the host machine, potentially leading to code execution or root privilege escalation.
- Exploit Mechanism: Chains two weaknesses in Docker's archive pipeline: a filesystem race condition producing an inconsistent tar archive, and an extraction flaw that follows a planted symlink outside the target directory.
- Impact: Attackers can overwrite shell configs, executables, or the runc binary. This enables code execution as the logged-in user on macOS, or immediate root code execution on Linux if docker cp runs with elevated privileges. Docker's sbx cp is also affected.
More from Infra
- Intel's $20B Share Sale Draws Over $100B in Demand — firstadopter · 2026-08-11
- Nvidia Partners With Wall Street Giants to Fund $500B AI Infrastructure — 智东西 · 2026-08-11
- Running Local LLMs on M4 MacBook Pro: Ollama Integration Faces Slow Startup — chongdashu · 2026-08-11
- Big Tech's AI Infrastructure Debt Bubble and DeepMind's Decline — Stratechery · 2026-08-11
- AI CapEx Drives Growth: Singapore Raises 2026 GDP Forecast to 5.5% — menhguin · 2026-08-11
- Nvidia Guarantees Hardware Residual Value to Unlock $500B in AI Funding — The Decoder · 2026-08-11