A critical vulnerability in Docker, identified as CVE-2026-17106 and dubbed 'CopyEscape,' has been disclosed by the Imperva Red Team. This flaw allows malicious container operations to overwrite files on the host system and potentially gain root-level access in certain configurations. The vulnerability is found in the docker cp command and its equivalent, sbx cp, used in AI-agent workflows within Docker Sandboxes.
The issue arises from Docker's archive pipeline, which transfers files between a container and the host. When executing a command like docker cp, Docker packages the desired file path into a tar archive and passes it to the Docker CLI for local extraction. This process relies on the assumption that the archive is consistent and that files remain within the user-specified destination. However, researchers discovered a way to exploit a race condition and a flawed symlink check during this operation.
Attackers can manipulate the filesystem in a timed sequence, swapping directories to trick Docker into recording a path and then replacing it with a symlink pointing outside the intended location. This bypasses the sandbox, allowing arbitrary file placement. The vulnerability poses significant risks to CI/CD pipelines, developer workstations, and incident response processes, especially when retrieving data from compromised containers.
On macOS, Docker Desktop's local file extraction can lead to attackers overwriting critical files, potentially executing code upon opening a terminal. On Linux, if docker cp runs with elevated permissions, it can overwrite system binaries, granting immediate root access. The flaw also affects Docker Sandboxes, exposing AI environments to similar risks.
Docker has addressed the issue in recent updates to Docker Engine, CLI, Docker Desktop, and Docker Sandboxes. Organizations unable to upgrade immediately should avoid risky docker cp operations and ensure data is retrieved through isolated environments. This incident underscores the importance of recognizing archive extraction as a security boundary, vulnerable to symlink manipulation.