Docker Sandboxes sandbox escape via poisoned Git config (CVE-2026-121614)

CVE-2026-121614 affects Docker Sandboxes 0.31.0 before 0.50.0. Host-side Git commands did not neutralize repository-controlled Git configuration. An attacker who can modify a host repository's Git config—for example through a direct-mode sandbox with the repo mounted read-write—can set core.fsmonitor or another setting that invokes an external program. A later clone-mode fetch, or from 0.39.0 an sbx kit push, can run that program on the host with the user's privileges, outside the microVM. Clone-mode's read-only host mount alone cannot poison the config. Fixed in Docker Sandboxes 0.50.0 (released Oct 26 2026; CVE published ~Nov 3). Vendor CVSS 4.0 is 7.1 (High). Upgrade to 0.50.0+; avoid read-write mounts of untrusted repos until patched.

Why this severity: CVSS 4.0 7.1 sandbox escape to host code execution; needs write access to host Git config plus a later user-initiated Git operation

Started

Oct 26, 2026

CVE

CVE-2026-121614

• Docker
• #Sandboxes
• #Sandbox Escape
• #Git
• Supply chain