Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
Docker Sandboxes, the microVM isolation tool for development environments, contains a local code-execution vulnerability that bypasses its own threat model. The flaw, published November 6, 2026 as advisory ZDI-26-894 and tracked as CVE-2026-121614, allows a local attacker to execute code on the host before microVM isolation activates. Researcher Nitesh Surana of TrendAI Research reported the vulnerability on August 28, 2026. Docker released the fix in version 0.50.0.
- CVE-2026-121614 carries a CVSS 4.0 score of 7.1 (HIGH) per the official CVE record; the ZDI advisory does not report a score
- Affected versions are Docker Sandboxes 0.31.0 through 0.49.x; the fix is in 0.50.0
- The attack requires user interaction and local access; the vector is AV:L with UI:A
- Execution occurs outside the microVM, with the permissions of the user invoking the command
Facts: The Two-Phase Mechanism
This section reports only data documented in primary sources.
The vulnerability triggers during sandbox creation in clone mode. In this mode, Docker Sandboxes mounts the host repository read-only inside the microVM. The CVE-2026-121614 record specifies that the read-only mount itself does not permit modification of the Git configuration.
Advisory ZDI-26-894 describes the flaw as "launching an executable from an untrusted location" during clone-mode sandbox creation. The CVE record details the mechanism: Docker Sandboxes "do not neutralize repository-controlled Git configuration when running certain host-side Git commands."
The documented mechanism involves two distinct phases. Phase 1: the attacker modifies the repository's Git configuration, for example by setting core.fsmonitor or other directives that invoke an external program. This modification requires write access to the repository, obtainable via direct-mode sandboxes with read-write mounts or other vectors. Phase 2: the legitimate user performs clone-mode operations — git fetch or sbx kit push — that trigger host-side execution of the configured program. The executable "runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation."
"The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation." — CVE-2026-121614 Record
The CVE record classifies the flaw as CWE-15: External Control of System or Configuration Setting. The attack vector is local (AV:L), with user interaction required (UI:A) and low attack complexity (AC:L).
Analysis: The Paradox of a Sandbox That Executes Before It Isolates
This section contains editorial interpretations based on documented facts.
The architectural design of Docker Sandboxes presents a paradox: a tool built to run untrusted code in isolation instead runs untrusted code on the host before that isolation activates. The microVM becomes irrelevant if the damage occurs in the preparatory phase.
The read-only repository mount in clone mode appeared to be a sufficient guarantee. The primary CVE source refutes this assumption: the malicious configuration does not originate in clone mode; it travels with the repository from a prior phase. The lack of host-side sanitization turns the sandbox from a security container into an execution channel.
This pattern — deferred isolation over pre-compromised data — represents a recurring class of error in security tools that blur the boundary between preparation and execution.
Facts: Timeline and Sources
This section reports only data documented in primary sources.
Nitesh Surana of TrendAI Research reported the vulnerability to the vendor on August 28, 2026. The coordinated release of advisory ZDI-26-894 and the patch occurred on November 6, 2026.
The CVE-2026-121614 record lists affected versions as "0.31.0 before 0.50.0." The fix is confirmed in version 0.50.0.
This article relies on two convergent ZDI advisories (HTTP and HTTPS mirrors) and a CVE record, all linked to the TrendAI ecosystem. No independent third-party primary sources are available. The ZDI record does not report the CVSS score, which appears only in the CVE record. Exploitation in the wild is not documented.
What to Do Now
This section reports only actions documented in primary sources.
Upgrade to version 0.50.0. The CVE-2026-121614 record explicitly states that "The issue is fixed in version 0.50.0." This is the only mitigation documented by primary sources.
Verify versions in use. The vulnerable range is 0.31.0 through 0.49.x per the CVE record. Installations prior to 0.31.0 are not reported as affected.
Primary sources do not specify temporary mitigations beyond upgrading. Actions such as repository monitoring or user-interaction analysis fall under general security best practices but are not documented as verified mitigations for this vulnerability.
Analysis: The Lesson of the Unactivated Boundary
This section contains editorial interpretations based on documented facts.
CVE-2026-121614 exemplifies a particularly insidious class of flaw: one that exploits the bootstrap phase of a protection tool. The Docker Sandboxes microVM is not breached; it is simply bypassed. The attacker does not need to compromise the hypervisor, escape the container, or manipulate the kernel — they only need to convince Git to execute a program before the sandbox exists.
The direct quote from the CVE record — "outside the sandbox's microVM isolation" — carries specific weight in this context. It describes not a violation, but a legitimate execution in the wrong context, at the wrong moment. The system does exactly what it is asked to do, and that is the problem.
For developers using Docker Sandboxes to contain source code of varying provenance, the lesson is structural: the isolation perimeter must begin before the first command, not after.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.