Remote Code Execution in Docker Sandboxes (CVE‑2026‑121614) Allows Untrusted Code Execution
What It Is — Docker’s “Sandboxes” feature contains a flaw in its clone‑mode sandbox creation logic. An attacker who can convince a user to open a malicious page or file can cause Docker to launch an executable from an untrusted location, resulting in arbitrary code execution in the context of the current user. The vulnerability is rated CVSS 7.8 (High) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Docker released a patch shortly after coordinated disclosure.
Affected Products — Docker Sandboxes (all versions prior to the November 2026 update).
Why It Matters for Trust & Control Assurance — This issue tests the control objective of secure configuration and execution‑environment isolation, a core element that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions —
- Deploy Docker’s November 2026 security update immediately.
- Verify sandbox creation policies to ensure only trusted binaries are allowed to run.
- Record the patch status and configuration settings as audit evidence.
Source: Zero Day Initiative Advisory