Docker has fixed a flaw in Docker Sandboxes that could let code inside a sandbox break out and run programs on the host machine. The bug, tracked as CVE-2026-121614, affects Docker Sandboxes versions 0.31.0 to before 0.50.0 and is rated High, with a CVSS score of 7.1.

The problem lies in how Sandboxes run Git commands on the host. When a sandbox is created from a repository, host-side Git commands do not neutralise settings stored in that repository's Git configuration. An attacker who can change the repository's .git config, for example through a direct-mode sandbox with the repository mounted read-write, can set core.fsmonitor or another Git setting that calls an external program.

Git can then run that program during a later clone-mode fetch, or during an sbx kit push on versions from 0.39.0 onwards. The program runs on the host with the user's own permissions, outside the sandbox's microVM isolation, which is exactly the boundary Sandboxes are meant to enforce. The flaw was reported through the Zero Day Initiative as ZDI-26-894.

Docker fixed the issue in Sandboxes 0.50.0, released on 26 October 2026, and the CVE record was published on 3 November. There is no confirmed exploitation in the wild, and the flaw is not listed in the US CISA catalogue of known exploited vulnerabilities.

Users should upgrade Docker Sandboxes to version 0.50.0 or later. Until then, Docker advises against running clone-mode sandbox creation or an sbx kit push in any repository whose Git configuration or .git data could have been changed by untrusted code, including repositories mounted read-write into another sandbox.