# Docker Sandboxes: running sbx as root can hand over the host

> Docker Sandboxes trusts whatever state directory HOME points at, which matters when the agent sandbox runs as root.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Docker
- **Disclosed:** 2026-11-12
- **CVE:** CVE-2026-126329
- **CVSS:** 7.3
- **Affects:** Docker Sandboxes, sbx, sandboxd
- **Research by:** Docker
- **Primary source:** https://github.com/advisories/GHSA-w92q-8xxw-h4r9
- **Page:** https://theinjection.dev/items/docker-sandboxes-state-ownership-root/

Docker Sandboxes reuses state and configuration directories without checking who owns them, so running sbx or sandboxd as root with an attacker-controlled HOME can reach command execution as root. The advisory gives 0.53.0 as the fix.

## What happened

CVE-2026-126329 was published against Docker Sandboxes on November 12, 2026 with a CVSS v4.0 score of 7.3. A second, much lower-rated flaw, CVE-2026-126330, appeared the same day. Docker had released Sandboxes 0.53.0 on November 11 and names only CVE-2026-126330 in those release notes.

## How it works

Docker Sandboxes reuses existing state and configuration directories without checking their ownership. When sbx or sandboxd runs as root and HOME, or XDG_STATE_HOME on Linux, points somewhere a local unprivileged user controls, that user can replace the control-plane sockets and configuration the root process trusts, and reach command execution as root. The advisory records the weakness as improper ownership management and lists Linux and macOS as affected.

## Who is affected

Workstations and build hosts that run the sbx CLI or the sandboxd daemon with elevated privileges, on Linux or macOS. The advisory names a local unprivileged user as the attacker and says exploitation needs a privileged invocation whose environment that user can influence, which points at shared and multi-user machines. Docker Sandboxes is the product Docker ships for running AI coding agents in isolated local or cloud environments.

## What to do

Upgrade Docker Sandboxes to 0.53.0 or later, which the advisory gives as the fixed version. Avoid running sbx or sandboxd as root at all, and never let an unprivileged user set HOME or XDG_STATE_HOME for a privileged invocation.

## Quick facts

- **Affected:** Docker Sandboxes on Linux and macOS, through the sbx CLI and the sandboxd daemon
- **Fixed in:** 0.53.0, released November 11, 2026
- **CVEs:** CVE-2026-126329 and CVE-2026-126330
- **CVSS:** 7.3 CVSS v4.0 for CVE-2026-126329, and 2.4 for CVE-2026-126330
- **Weakness:** CWE-282, improper ownership management
- **Disclosed:** November 12, 2026

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-w92q-8xxw-h4r9)
2. [Port Republish Flaw](https://github.com/advisories/GHSA-42wc-3p53-v4wg)
3. [Release 0.53.0](https://github.com/docker/sbx-releases/releases/tag/v0.53.0)
4. [Docker Sandboxes Docs](https://docs.docker.com/ai/sandboxes/)