CVE-2026-79994

Executive Summary

CVE-2026-79994 is a time-of-check-to-time-of-use (TOCTOU) vulnerability (CWE-367) in the guest-to-host Unix-domain socket relay component of Docker Sandboxes. The relay validates that a requested socket path resides inside an authorized workspace, but then performs the actual connection using the pathname evaluated at a later moment, allowing a malicious guest to insert a symlink for an intermediate directory between validation and connection. This enables the host process to be redirected to arbitrary AF_UNIX sockets outside the shared workspace, potentially exposing sensitive host data or capabilities reachable through those sockets. Docker Sandboxes users who expose Unix-domain sockets to guest workloads — particularly in multi-tenant or untrusted-guest scenarios — are the primary affected population.

Technical Analysis

The vulnerability resides in the "guest-to-host Unix-domain socket relay" component of Docker Sandboxes. Architecturally, such relays exist to bridge sockets exposed by host-side services into a guest VM or container so that processes inside the guest can communicate with host capabilities without exposing the full host filesystem. Because the guest is by definition less trusted than the host, the relay must enforce a path authorization policy: any socket path the guest requests to reach must be confined to a "shared workspace" directory tree.

CVE-2026-79994 is a classic TOCTOU (CWE-367) failure of that policy. The relay performs two logically distinct operations:

1. Validation (check): it determines whether the requested socket path is located inside an authorized workspace. This is typically implemented via a path canonicalization or prefix comparison.
2. Connection (use): it then opens/connects to the socket using the pathname.

The gap between these two operations is exploitable because filesystem objects on the host are mutable. A malicious guest that has write access to any directory in the path between the workspace root and the final socket — specifically an intermediate directory — can:

• first present a path that resolves to a legitimate in-workspace location, passing validation;
• then, in the window before the relay actually connects, replace that intermediate directory with a symlink pointing outside the workspace;
• cause the subsequent connect() on the AF_UNIX socket to resolve the symlink and reach an arbitrary host socket that was never authorized.

Because the bind/connect operates on AF_UNIX sockets (a host-local IPC mechanism), the impact is not remote network access but a local privilege boundary violation across the guest/host trust boundary. The description explicitly states the outcome: the host may "connect to an arbitrary AF_UNIX socket outside the shared workspace," which "can expose data or host-side capabilities provided by the targeted socket."

Note on specifics: no function names, class names, API parameters, or internal file paths are provided in the available NVD description. The analysis above therefore describes the vulnerability class (TOCTOU on symlink resolution in a path-authorization relay) and the mechanism (validate-then-connect on a mutable pathname) at the level of abstraction supported by the source text. No public PoC, exploit code, or Nuclei template was observed.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred strictly from the vulnerability class and the NVD-provided mechanism; no implementation-specific identifiers are asserted.

1. Reconnaissance / target identification. The attacker controls a guest workload (VM, container, or sandbox) that has been granted access to a shared workspace containing at least one Unix-domain socket relayed to the host. The attacker enumerates the relay's behavior, identifies the workspace path root, and locates at least one intermediate directory within an authorized path that the guest can manipulate.

2. Triggering the flaw class (TOCTOU). The attacker causes the relay to initiate a socket request for a path that, at validation time, resolves inside the authorized workspace. The attacker then races the relay by replacing an intermediate directory component of that path with a symlink that points outside the workspace. This is a race between the validation step and the subsequent connection step, characteristic of CWE-367.

3. Payload / execution at the vulnerability-class level. When the relay connects using the now-mutated pathname, the kernel follows the symlink and the AF_UNIX connect() targets an arbitrary host socket — one the guest should never have been authorized to reach. The attacker does not necessarily need code execution on the host; the "payload" is the redirection of an already-privileged IPC connection to the attacker-chosen endpoint.

4. Post-exploitation impact. Depending on which host sockets are reachable, the attacker may be able to query privileged services, read data exposed by those sockets, or trigger host-side capabilities offered by the targeted socket. The NVD text is explicit that this may "expose data or host-side capabilities." The blast radius is bounded by the set of AF_UNIX sockets present on the host and reachable from the relay's context, but any such exposure crosses the intended guest/host isolation boundary.

Impact Assessment

• Confidentiality (High): arbitrary host AF_UNIX sockets can be reached, potentially leaking data from host services.
• Integrity (High): capabilities exposed by the targeted socket may permit state-changing operations on the host.
• Availability (None asserted): the description does not indicate denial of service.
• Scope (Changed): the flaw violates the guest/host isolation boundary — the security authority of the relay (host) is different from that of the attacker (guest), satisfying S:C.
• Attack Vector (Local): exploitation requires a position inside a guest that can race the relay and manipulate the workspace path — a local attacker relative to the relay's host.
• Attack Complexity (High): it is a race condition requiring precise timing and control of an intermediate directory.
• Privileges Required (Low): the attacker only needs guest-level write access to an intermediate path component.
• User Interaction (None).

No CVSS score or vector was provided by NVD/CNA; the vector above is a reasoned estimate based on the described mechanism and should be treated as analytical, not authoritative. CISA KEV status: NO. EPSS: 0.00106 (1.2nd percentile) — very low observed exploitation likelihood as of publication, though EPSS reflects broad exploitation telemetry, not the risk within any single deployment.

Detection Guidance

Detection must target the TOCTOU race and symlink-substitution behavior in shared workspace directories, plus the resulting unauthorized AF_UNIX connections.

Sigma Rule

title: Docker Sandboxes Guest-to-Host UDS Relay Symlink TOCTOU (CVE-2026-79994)
id: 9f1c3a2e-77b4-4d10-8a6e-2c5f0b1d7999
status: experimental
description: Detects creation of symlinks in Docker sandbox shared-workspace paths that may indicate TOCTOU racing against the guest-to-host Unix-domain socket relay.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79994
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: linux
detection:
  selection_op:
    EventType: 'symlink'
  selection_path:
    TargetFilename|contains:
      - '/workspace/'
      - '/sandbox/'
      - '/.docker/'
  condition: selection_op and selection_path
falsepositives:
  - Legitimate developer tooling that creates symlinks inside shared workspaces.
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.79994

YARA Rule

rule CVE_2026_79994_Docker_Sandbox_UDS_Relay_TOCTOU
{
    meta:
        description = "Detects artifacts referencing Docker Sandboxes UDS relay symlink TOCTOU"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79994"
        date = "2026-01-01"
        cve = "CVE-2026-79994"

    strings:
        $cve   = "CVE-2026-79994" ascii wide nocase
        $relay = "socket relay" ascii wide nocase
        $ws    = "workspace" ascii wide nocase
        $unix  = "AF_UNIX" ascii wide nocase

    condition:
        $cve or ($relay and ($ws or $unix))
}

Suricata IDS Rule

alert unix any any -> any any (msg:"CVE-2026-79994 Possible Docker Sandbox UDS Relay Path Traversal via Symlink"; flow:to_server; content:"workspace"; nocase; pcre:"/(\\.\\.|\\/)/"; metadata:cve CVE-2026-79994, created_at 2026-01-01, updated_at 2026-01-01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79994; classtype:attempted-user; sid:202679994; rev:1;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and
  process.name in ("docker", "dockerd", "containerd", "runc") and
  process.command_line : "*socket*" and
  process.command_line : "*workspace*"

Splunk SPL Query

index=linux_audit OR index=osquery
(EventType=symlink OR action=SYMLINK OR operation=symlink)
(TargetFilename="*workspace*" OR TargetFilename="*sandbox*" OR Path="*workspace*")
| stats count min(_time) as firstTime max(_time) as lastTime
  by host, TargetFilename, ProcessName, User
| where count > 1
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="docker_cve_2026_79994,">
  <rule id="202679940" level="10">
    <decoded_as>syscheck</decoded_as>
    <field name="file">\.(workspace|sandbox)\/</field>
    <field name="changed_fields">symbolic_links</field>
    <description>CVE-2026-79994: Symlink change inside Docker sandbox shared workspace (possible UDS relay TOCTOU race).</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,docker,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). OSV lists the affected package as e4809b108ff941fbd3dc8ab1edd8755af78ddc07→unfixed, i.e., no confirmed fixed version is available from the single source. Treat any "patched" claim as unverified until the vendor publishes a canonical advisory.

1. Immediate mitigations

   • Do not grant untrusted guest workloads write access to intermediate directories of any path prefix exposed to the guest-to-host Unix-domain socket relay.
   • Constrain the set of host AF_UNIX sockets reachable from the relay process (filesystem permissions, mount namespaces, or scoped relay agents).
   • Monitor for symlink creation inside shared workspace trees and for relay processes connecting to sockets outside the expected workspace.

2. Patch / upgrade steps

   • Monitor the Docker security advisory channel and OSV entry for a confirmed fixed release; do not rely on the unconfirmed single-source patch claim.
   • When a fixed version is published, verify the digest/signature, schedule a maintenance window, and redeploy sandbox hosts with the patched relay.
   • Re-validate existing guests for residual symlinks left in shared workspaces.

3. Long-term hardening

   • Require the relay to resolve and lock the target inode (e.g., openat with O_NOFOLLOW and a held file descriptor) rather than re-resolving a pathname after validation.
   • Perform path authorization using file descriptors and openat2-style RESOLVE_BENEATH-equivalent constraints to eliminate the check/use window.
   • Adopt a least-privilege model for all AF_UNIX sockets exposed to guests; segregate sockets per tenant with filesystem and namespace isolation.
   • Add CI regression tests that simulate symlink substitution races against the relay.

References

• NVD — CVE-2026-79994: https://nvd.nist.gov/vuln/detail/CVE-2026-79994
• OSV — CVE-2026-79994 (single source listed; commit e4809b108ff941fbd3dc8ab1edd8755af78ddc07): https://osv.dev/vulnerability/CVE-2026-79994
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Docker security advisories (monitor for a confirmed fixed version): https://docs.docker.com/security/

Exploitation-in-the-wild evidence: None identified. CISA KEV: NO. EPSS 0.00106 (1.2nd percentile). No public PoC, exploit code, or Nuclei template was observed. No threat actor campaigns are associated with this CVE in the provided data.