EUVD-2026-37893
GHSA-x6hr-f96v-hhgg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because exploitation requires code execution inside the sandbox; AC:H maps the daemon-restart prerequisite (AT:P in 4.0); S:C captures the sandbox boundary escape enabling external ICMP traffic.
Primary rating from Vendor (docker).
CVSS VectorVendor: docker
Lifecycle Timeline
3DescriptionCVE.org
Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlist.
AnalysisAI
ICMP egress policy bypass in Docker Sandboxes (sbx) allows untrusted workloads - explicitly including AI agents - to defeat the documented ICMP block and reach arbitrary external hosts after a Docker daemon restart. The authorizer enforcing the ICMP egress restriction is applied only at network-creation time and is never re-applied when the daemon reconstructs network state from disk on restart, leaving the policy unenforced for the lifetime of the rebuilt network. No public exploit has been identified at time of analysis, but the bypass enables network reconnaissance and covert-channel data exfiltration directly contradicting the sbx threat model, which treats sandbox workloads as adversarial.
Technical ContextAI
Docker Sandboxes (sbx) is Docker's AI-agent isolation product, designed to contain untrusted workloads such as code-executing AI agents behind strict network policy including ICMP egress blocking. The root cause is CWE-665 (Improper Initialization): the authorizer object responsible for enforcing the ICMP egress rule is attached to the network object at creation time but is not re-instantiated or re-bound when the Docker daemon restarts and deserializes network state from disk. This produces a divergence between the intended policy and the enforced runtime state - the network exists and routes traffic, but the authorizer gate for ICMP is absent. The Docker Sandboxes release notes for v0.33.0 (https://github.com/docker/sbx-releases/releases/tag/v0.33.0) explicitly confirm the fix: 'ICMP egress is blocked across daemon restarts,' validating the described root cause. The same release also addressed a related DNS-based exfiltration channel (DNS lookups gated on network policy), suggesting a broader audit of policy re-initialization across daemon restarts was conducted.
RemediationAI
Upgrade Docker Sandboxes (sbx) to v0.33.0 or later, which resolves the issue by ensuring ICMP egress remains blocked across daemon restarts, as confirmed in the release notes at https://github.com/docker/sbx-releases/releases/tag/v0.33.0. Prior to patching, administrators can apply host-level iptables or nftables rules to drop outbound ICMP traffic originating from sandbox network namespaces or bridge interfaces - for example, matching on the sandbox bridge interface and protocol ICMP to OUTPUT/FORWARD chains. Note that host-level ICMP blocking may suppress legitimate connectivity diagnostics and ping-based health checks. Network-level monitoring for ICMP traffic from sandbox network namespaces can also serve as a detection control rather than prevention. Restricting daemon restarts during active sandbox sessions is an additional risk-reduction measure, though operationally impractical in most environments. No vendor advisory URL beyond the release notes and product docs was provided in the input data.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-665 – Improper Initialization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today