INFRA Signal 402

Docker Sandbox read-only mount bypass (CVE-2026-18171) lets code write via /mnt/host

Aikido Security's Blog 2 hours ago 6 min read ↗ Original

A second VirtioFS path in Docker Sandboxes 0.35.0 to 0.38.0 lets sandboxed code write to read-only mounts, fixed in 0.38.0.

WHY IT MATTERS

Developers using Docker Sandboxes to isolate coding agents may have read-only mounts silently writable, so a compromised agent can alter source, CI configs, or build inputs. The fix requires updating to 0.38.0; the bypass is trivial to find with findmnt.

Written by elseif from the cluster below · every claim links back to a source

The three things worth knowing

Docker Sandboxes 0.35.0 through 0.38.0 expose a second writable VirtioFS path at /mnt/host that bypasses read-only mounts.

The bypass lets a compromised agent modify files in read-only directories, which can later execute on the host or in CI.

Docker assigned CVE-2026-18171 with a CVSS score of 5.7 and fixed it in version 0.38.0.

THE CLUSTER

Same story, 1 feed.

ORDERED BY FIRST SEEN

Aikido Security's Blog When read-only mounts in Docker Sandboxes become writable 2 hours Open ↗