A newly disclosed Docker vulnerability, tracked as CVE-2026-17106 and nicknamed “CopyEscape,” allows malicious containers to overwrite files on the host machine and achieve full root code execution in certain configurations. If exploited, CopyEscape enables a malicious container to escape its isolated environment, write or overwrite arbitrary files on the client host, and under specific conditions on Linux, achieve root-level code execution. CopyEscape Docker Vulnerability Enables Root Access Instead, the daemon traverses the live filesystem of the container, packaging selected paths into tar archives that are then handed over to the Docker CLI for extraction on the local machine.
- However, Imperva’s researchers discovered vulnerabilities in both these aspects.
Symlink Race Condition Steps (Image Source: Imperva.com) Because docker cp underpins routine tasks like collecting build artifacts, logs, and forensic evidence, this vulnerability directly threatens CI/CD pipelines, developer workstations, and incident-response workflows. Docker has patched the issue in versions 29.7.2 of Docker Engine and CLI, 4.86.0 of Docker Desktop, and 0.38.0 of Docker Sandboxes, following a disclosure process that began in April 2026 and required multiple extensions to resolve regressions from an earlier fix. Organizations unable to upgrade immediately should avoid running docker cp against untrusted or live containers, stop containers before copying files, eliminate sudo docker cp usage, and retrieve suspicious data only through isolated, disposable environments.
Register now!
