Docker Sandboxes flaw let AI agents read host credentials outside the sandbox
Endor Labs says CVE-2026-103916 abused symbolic links through the sbx cp command to expose files such as cloud credentials and SSH keys; Docker fixed it in version 0.51.0.
Why it matters
Docker Sandboxes are meant to let coding agents run untrusted code without touching the developer's machine, so an escape undercuts the main promise of agent isolation. The bug, found by Endor Labs researcher Peyton Kennedy, meant a malicious repository or a prompt-injected agent could plant a symbolic link and then have files copied out from the host. Docker shipped the fix in version 0.51.0 on 3 November, later than the 13 October date first planned, and a separate Git configuration escape, CVE-2026-121614, was published the same day. Teams running agents in these sandboxes should update now.
Key facts
- Found by Endor Labs researcher Peyton Kennedy
- Abuses symbolic links through the sbx cp command
- Could expose cloud credentials and SSH keys
- Fixed in version 0.51.0 on 3 November
- Separate Git config escape CVE-2026-121614 published the same day