Docker Sandboxes: running sbx as root can hand over the host
Docker Sandboxes trusts whatever state directory HOME points at, which matters when the agent sandbox runs as root.
· Docker · Research by Docker
Docker Sandboxes reuses state and configuration directories without checking who owns them, so running sbx or sandboxd as root with an attacker-controlled HOME can reach command execution as root. The advisory gives 0.53.0 as the fix.
01What happened
CVE-2026-126329 was published against Docker Sandboxes on November 12, 2026 with a CVSS v4.0 score of 7.3. A second, much lower-rated flaw, CVE-2026-126330, appeared the same day. Docker had released Sandboxes 0.53.0 on November 11 and names only CVE-2026-126330 in those release notes.
02How it works
Docker Sandboxes reuses existing state and configuration directories without checking their ownership. When sbx or sandboxd runs as root and HOME, or XDG_STATE_HOME on Linux, points somewhere a local unprivileged user controls, that user can replace the control-plane sockets and configuration the root process trusts, and reach command execution as root. The advisory records the weakness as improper ownership management and lists Linux and macOS as affected.
03Who is affected
Workstations and build hosts that run the sbx CLI or the sandboxd daemon with elevated privileges, on Linux or macOS. The advisory names a local unprivileged user as the attacker and says exploitation needs a privileged invocation whose environment that user can influence, which points at shared and multi-user machines. Docker Sandboxes is the product Docker ships for running AI coding agents in isolated local or cloud environments.
04What to do
Upgrade Docker Sandboxes to 0.53.0 or later, which the advisory gives as the fixed version. Avoid running sbx or sandboxd as root at all, and never let an unprivileged user set HOME or XDG_STATE_HOME for a privileged invocation.
Sources 4 links, all fetched
- 1github.comGitHub Advisory
- 2github.comPort Republish Flaw
- 3github.comRelease 0.53.0
- 4docs.docker.comDocker Sandboxes Docs