Docker patches root privilege escalation flaw in Docker Sandboxes

Docker disclosed on November 12, 2026, that its Docker Sandboxes code-execution environment, used to isolate code run by AI coding agents, contained a high-severity flaw that let a local unprivileged user gain root access, according to the GitHub Security Advisory GHSA-w92q-8xxw-h4r9.

Concrete details of the flaw

• Advisory GHSA-w92q-8xxw-h4r9 (CVE-2026-126329), rated High severity with a CVSS v4 score of 7.3 and classified as CWE-282 (improper ownership management).
• A local unprivileged user can hijack control-plane sockets and configuration by exploiting inherited HOME and XDG_STATE_HOME environment variables when the sandbox runs as root.
• The flaw leads to root-level command execution and affects both Linux and macOS.
• The issue is patched in Docker Sandboxes v0.53.0.
• A companion low-severity advisory, GHSA-42wc-3p53-v4wg (CVE-2026-126330), published the same day, covers the daemon silently republishing a sandbox service on a new port, fixed in the same release.

What it means for AI builders

Docker Sandboxes exists to isolate code that AI coding agents execute, so a root-escalation flaw in that isolation layer undermines the core security assumption teams rely on when letting agents run untrusted generated code.

Next steps

Teams running Docker Sandboxes to contain agent-generated code should upgrade to v0.53.0, which fixes both the root privilege escalation and the companion port-republishing issue disclosed the same day.

Sources

• Docker Sandboxes root privilege escalation via inherited environment variables (GitHub Security Advisories, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.