CVE-2026-121614: Docker Sandboxes Unauthenticated Code Execution — Detection and Remediation Guide | Security Arsenal

The Zero Day Initiative (ZDI) has published ZDI-26-894, disclosing CVE-2026-121614 — a critical vulnerability in Docker Sandboxes that enables unauthenticated local attackers to execute arbitrary code. With a CVSS 3.1 score of 7.8 (High), this vulnerability represents a significant risk to development environments, CI/CD pipelines, and any infrastructure relying on Docker Sandboxes for isolation.

The vulnerability stems from the inclusion of functionality from an untrusted control sphere — a design flaw where the sandbox trusts code or instructions from origins it cannot verify. For security teams managing containerized workloads, this is not a theoretical concern. This is a sandbox escape primitive that, when combined with social engineering or supply-chain manipulation, can lead to full host compromise.

Technical Analysis

Vulnerability Overview

Attribute	Detail
CVE	CVE-2026-121614
ZDI Advisory	ZDI-26-894
CVSS 3.1	7.8 (High)
Vector	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Product	Docker Sandboxes
Vulnerability Class	Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

How the Vulnerability Works

The CVSS vector tells us the story: Local attack vector (AV:L), Low complexity (AC:L), No privileges required (PR:N), User interaction required (UI:R).

The vulnerability manifests when Docker Sandboxes accepts and executes code or configuration from an untrusted origin without sufficient validation. In practical terms, this means:

Attack Surface: The sandbox environment fails to properly verify the trust boundary between the host and guest, or between different sandboxed contexts.
Trigger Condition: User interaction is required — the target must visit a malicious page or open a malicious file. This is consistent with attacks leveraging malicious .tar archives, OCI images, or crafted Dockerfile instructions.
Impact: Once triggered, arbitrary code executes outside the intended sandbox boundary, achieving host-level compromise.

The untrusted control sphere weakness indicates that Docker Sandboxes may load plugins, extensions, or configuration directives from remote or user-controllable sources without enforcing cryptographic verification or strict origin policies. This is a supply-chain and social engineering vector combined into a single exploit primitive.

Attack Chain (Defender's Perspective)

Code

1. Attacker crafts malicious OCI image / Dockerfile / web page
   ↓
2. Target user visits page or opens file (UI:R)
   ↓
3. Docker Sandboxes processes untrusted input without validation
   ↓
4. Arbitrary code executes with sandbox/host privileges
   ↓
5. Attacker achieves persistence, lateral movement, or data exfiltration

Exploitation Status

Public PoC: Not confirmed as of this writing
Active Exploitation: Not confirmed, but the vulnerability class is attractive to red teams and APT actors targeting developer environments
CISA KEV: Not yet added (monitor for updates)

Detection & Response

SIGMA Rules

The following Sigma rules target observable behaviors consistent with exploitation of this vulnerability: anomalous process spawning from Docker components, suspicious file writes to sandbox configuration paths, and unexpected child processes.

YAML

---
title: Docker Sandboxes Suspicious Child Process Execution
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes spawned by Docker daemon or sandbox components, consistent with CVE-2026-121614 exploitation attempts.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-894/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\docker.exe'
      - '\dockerd.exe'
      - '\com.docker.backend.exe'
      - '\com.docker.service.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection
falsepositives:
  - Legitimate Docker builds invoking shell commands
  - CI/CD pipeline scripts
level: high
---
title: Docker Sandboxes Configuration File Modification
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects unauthorized modifications to Docker daemon configuration or sandbox policy files, which may indicate exploitation of CVE-2026-121614.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-894/
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1562
  - attack.t1554
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Docker\Docker Desktop\settings.json'
      - '\.docker\daemon.json'
      - '\docker\config.json'
      - '\ProgramData\Docker\config\'
  condition: selection
falsepositives:
  - Legitimate Docker Desktop updates
  - Administrator configuration changes
level: medium
---
title: Docker Sandboxes Unexpected Network Connections
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects Docker sandbox processes establishing unexpected outbound network connections, potentially indicating post-exploitation C2 or data exfiltration.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-894/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\docker.exe'
      - '\dockerd.exe'
      - '\com.docker.backend.exe'
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  filter_local:
    DestinationIp|startswith:
      - '127.'
  condition: selection and not filter_local
falsepositives:
  - Docker Hub image pulls
  - Registry authentication
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for Docker Sandboxes exploitation indicators - CVE-2026-121614
// Targets: Suspicious process spawning from Docker components
// Recommended data sources: DeviceProcessEvents, SecurityEvent (4688), Syslog

// Query 1: Docker spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ (
    "docker.exe", "dockerd.exe", "com.docker.backend.exe", 
    "com.docker.service.exe", "docker-compose.exe"
)
| where FileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", 
    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
    "certutil.exe", "bitsadmin.exe", "msiexec.exe"
)
| project TimeGenerated, DeviceName, AccountName, 
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256
| sort by TimeGenerated desc

// Query 2: Docker configuration file access/modification
| union isfuzzy=true
    (DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FolderPath has_any ("Docker", ".docker", "daemon.json", "config.json")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where not(InitiatingProcessFileName has_any ("docker", "com.docker"))
    | project TimeGenerated, DeviceName, AccountName, 
        FolderPath, FileName, ActionType, InitiatingProcessFileName
    )

// Query 3: Docker network connections to external IPs (non-registry)
| union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName has_any ("docker", "com.docker")
    | where RemoteIPType == "Public"
    | where not(RemoteUrl has_any ("docker.io", "docker.com", "registry-1.docker.io"))
    | summarize ConnectionCount = count(), 
        UniquePorts = make_set(RemotePort) by 
        DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
    | where ConnectionCount > 10
    )

Velociraptor VQL

VQL — Velociraptor

-- Docker Sandboxes Exploitation Hunt - CVE-2026-121614
-- Target: Process execution anomalies and persistence mechanisms
-- Scope: Windows endpoints running Docker Desktop / Docker Engine

LET docker_processes = SELECT Pid, Ppid, Name, Exe, CommandLine, 
    Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)docker|com\.docker'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, 
    Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM docker_processes)
  AND Name =~ '(?i)cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil'

LET docker_config_access = SELECT FullPath, Size, Mtime, Ctime, Atime,
    parse_pe(file=FullPath) AS PE
FROM glob(globs=[
    'C:\Users\*\.docker\*.json',
    'C:\ProgramData\Docker\config\*.json',
    'C:\Program Files\Docker\**\*.json'
])
WHERE Mtime > now() - 86400  -- Last 24 hours

LET docker_network = SELECT Pid, Name, Path, LocalAddr, LocalPort,
    RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)docker|com\.docker'
  AND RemoteAddr !~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)'
  AND Status = 'ESTABLISHED'

SELECT * FROM suspicious_children
UNION ALL
SELECT NULL, NULL, FullPath, NULL, NULL, NULL, Mtime FROM docker_config_access
UNION ALL  
SELECT Pid, NULL, Name, RemoteAddr + ':' + RemotePort, NULL, NULL, NULL FROM docker_network

Remediation Script (PowerShell)

PowerShell

# CVE-2026-121614: Docker Sandboxes Hardening and Verification Script
# Security Arsenal - Incident Response Team
# Run as Administrator on systems with Docker Desktop/Engine installed

param(
    [switch]$AuditOnly,
    [switch]$ForceRestart
)

$ErrorActionPreference = 'Continue'
$LogPath = "$env:TEMP\Docker_CVE-2026-121614_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $logEntry = "[$timestamp] [$Level] $Message"
    Write-Host $logEntry
    Add-Content -Path $LogPath -Value $logEntry
}

Write-Log "=== CVE-2026-121614 Docker Sandboxes Audit ===" "HEADER"
Write-Log "Hostname: $env:COMPUTERNAME"
Write-Log "User: $env:USERNAME"
Write-Log "Audit Mode: $AuditOnly"

# 1. Detect Docker Installation
Write-Log "[1] Checking for Docker installation..."
$dockerPaths = @(
    "${env:ProgramFiles}\Docker\Docker",
    "${env:ProgramFiles(x86)}\Docker",
    "$env:LOCALAPPDATA\Docker",
    "$env:USERPROFILE\.docker"
)

$dockerInstalled = $false
foreach ($path in $dockerPaths) {
    if (Test-Path $path) {
        Write-Log "Docker found at: $path"
        $dockerInstalled = $true
    }
}

if (-not $dockerInstalled) {
    Write-Log "Docker not detected on this system. Exiting." "WARN"
    exit 0
}

# 2. Check Docker Version
Write-Log "[2] Checking Docker version..."
try {
    $dockerVersion = docker version --format '{{.Server.Version}}' 2>$null
    $dockerDesktopVersion = docker desktop version 2>$null | Select-String -Pattern 'Version' | ForEach-Object { $_.Line }
    Write-Log "Docker Engine Version: $dockerVersion"
    if ($dockerDesktopVersion) {
        Write-Log "Docker Desktop: $dockerDesktopVersion"
    }
    
    # Check if version is vulnerable (placeholder - update with actual patched version)
    $vulnerableVersions = @('4.25.0', '4.26.0', '4.27.0', '4.28.0')  # Update per vendor advisory
    if ($vulnerableVersions -contains $dockerVersion) {
        Write-Log "CRITICAL: Vulnerable Docker version detected!" "ALERT"
        Write-Log "Update to latest version immediately: https://docs.docker.com/desktop/release-notes/"
    }
}
catch {
    Write-Log "Unable to query Docker version: $_" "WARN"
}

# 3. Audit Docker Configuration for Insecure Settings
Write-Log "[3] Auditing Docker configuration..."

$daemonConfigPath = "$env:USERPROFILE\.docker\daemon.json"
$dockerDesktopSettings = "$env:APPDATA\Docker\settings.json"

$insecureSettings = @(
    @{ Path = $daemonConfigPath; Pattern = '"insecure-registries"'; Risk = 'Insecure registry configured' },
    @{ Path = $daemonConfigPath; Pattern = '"experimental"\s*:\s*true'; Risk = 'Experimental features enabled' },
    @{ Path = $daemonConfigPath; Pattern = '"live-restore"\s*:\s*false'; Risk = 'Live restore disabled' },
    @{ Path = $dockerDesktopSettings; Pattern = '"exposeDockerAPIOnTCP2375"\s*:\s*true'; Risk = 'Docker API exposed on TCP 2375 (unencrypted)' },
    @{ Path = $dockerDesktopSettings; Pattern = '"useWindowsContainers"\s*:\s*true'; Risk = 'Windows containers enabled (increased attack surface)' }
)

foreach ($setting in $insecureSettings) {
    if (Test-Path $setting.Path) {
        $content = Get-Content $setting.Path -Raw
        if ($content -match $setting.Pattern) {
            Write-Log "FINDING: $($setting.Risk) in $($setting.Path)" "FINDING"
        }
    }
}

# 4. Check for Suspicious Docker Processes
Write-Log "[4] Checking for anomalous Docker processes..."
$dockerProcs = Get-Process | Where-Object { $_.ProcessName -match 'docker|com.docker' }
$suspiciousChildren = @()

foreach ($proc in $dockerProcs) {
    $children = Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.Id }
    foreach ($child in $children) {
        if ($child.Name -match 'cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil') {
            $suspiciousChildren += [PSCustomObject]@{
                Parent = $proc.ProcessName
                ParentPID = $proc.Id
                Child = $child.Name
                ChildPID = $child.ProcessId
                CommandLine = $child.CommandLine
            }
        }
    }
}

if ($suspiciousChildren.Count -gt 0) {
    Write-Log "ALERT: Suspicious child processes detected under Docker!" "ALERT"
    $suspiciousChildren | ForEach-Object {
        Write-Log "  $($_.Parent) ($($_.ParentPID)) -> $($_.Child) ($($_.ChildPID))" "ALERT"
        Write-Log "    Command: $($_.CommandLine)" "ALERT"
    }
}
else {
    Write-Log "No suspicious Docker child processes detected." "PASS"
}

# 5. Check Docker Network Exposure
Write-Log "[5] Checking Docker network exposure..."
$dockerListeners = Get-NetTCPConnection | Where-Object {
    $_.LocalPort -in @(2375, 2376, 5000) -and $_.State -eq 'Listen'
}

if ($dockerListeners) {
    Write-Log "FINDING: Docker listening on exposed ports:" "FINDING"
    $dockerListeners | ForEach-Object {
        Write-Log "  Port $($_.LocalPort) on $($_.LocalAddress)" "FINDING"
    }
    
    if ($dockerListeners.LocalPort -contains 2375) {
        Write-Log "CRITICAL: Port 2375 (unencrypted Docker API) is exposed!" "ALERT"
        Write-Log "Recommendation: Disable TCP 2375 or restrict to localhost" "REMEDIATION"
    }
}

# 6. Audit Recent Docker Image Pulls (from event logs)
Write-Log "[6] Auditing recent Docker activity (last 24 hours)..."
try {
    $dockerEvents = Get-WinEvent -FilterHashtable @{
        LogName = 'Application'
        ProviderName = 'Docker'
        StartTime = (Get-Date).AddHours(-24)
    } -ErrorAction SilentlyContinue | Select-Object -First 50
    
    if ($dockerEvents) {
        Write-Log "Found $($dockerEvents.Count) Docker events in last 24 hours"
        $pullEvents = $dockerEvents | Where-Object { $_.Message -match 'pull|Pulling' }
        if ($pullEvents) {
            Write-Log "Recent image pulls detected - verify image sources"
        }
    }
}
catch {
    Write-Log "Unable to query Docker event logs: $_" "WARN"
}

# 7. Check for Docker Extensions (potential attack surface)
Write-Log "[7] Checking for Docker extensions..."
$extensionsPath = "$env:USERPROFILE\.docker\extensions"
if (Test-Path $extensionsPath) {
    $extensions = Get-ChildItem $extensionsPath -Directory
    if ($extensions) {
        Write-Log "Docker extensions installed: $($extensions.Count)"
        foreach ($ext in $extensions) {
            Write-Log "  - $($ext.Name)"
            # Check extension manifest for suspicious entries
            $manifest = Join-Path $ext.FullName 'meta.json'
            if (Test-Path $manifest) {
                $manifestContent = Get-Content $manifest -Raw | ConvertFrom-Json
                if ($manifestContent.remote -or $manifestContent.external) {
                    Write-Log "    WARNING: Extension has remote/external references" "WARN"
                }
            }
        }
    }
}

# 8. Hardening Recommendations (if not AuditOnly)
if (-not $AuditOnly) {
    Write-Log "[8] Applying hardening recommendations..." "REMEDIATION"
    
    # Disable Docker API on TCP 2375 if enabled
    if (Test-Path $dockerDesktopSettings) {
        $settings = Get-Content $dockerDesktopSettings -Raw | ConvertFrom-Json
        if ($settings.exposeDockerAPIOnTCP2375) {
            Write-Log "Disabling Docker API on TCP 2375..." "REMEDIATION"
            $settings.exposeDockerAPIOnTCP2375 = $false
            $settings | ConvertTo-Json -Depth 10 | Set-Content $dockerDesktopSettings
            Write-Log "Docker API on TCP 2375 disabled. Restart required." "REMEDIATION"
        }
    }
    
    Write-Log "Manual hardening steps required:"
    Write-Log "  1. Update Docker Desktop to latest version"
    Write-Log "  2. Review and remove unnecessary extensions"
    Write-Log "  3. Enable 'Enhanced Container Isolation' in Docker Desktop settings"
    Write-Log "  4. Configure resource limits for sandboxed containers"
    Write-Log "  5. Implement network segmentation for Docker networks"
}

# 9. Summary and Next Steps
Write-Log "=== Audit Complete ===" "HEADER"
Write-Log "Log file: $LogPath"

if ($suspiciousChildren.Count -gt 0 -or $dockerListeners.LocalPort -contains 2375) {
    Write-Log "CRITICAL FINDINGS DETECTED - IMMEDIATE ACTION REQUIRED" "ALERT"
    exit 1
}
else {
    Write-Log "No critical findings. Review log for recommendations."
    exit 0
}

Remediation

Immediate Actions

Priority	Action	Timeline
P0	Update Docker Desktop/Engine to latest version	Within 24 hours
P0	Disable Docker API on TCP 2375 if exposed	Immediate
P1	Enable Enhanced Container Isolation	Within 72 hours
P1	Audit and remove unnecessary Docker extensions	Within 72 hours
P2	Implement network segmentation for Docker networks	Within 1 week

Patch Information

As of this writing, Docker has not released a specific patched version addressing CVE-2026-121614. Monitor the following official channels for updates:

Docker Desktop Release Notes: https://docs.docker.com/desktop/release-notes/
Docker Security Announcements: https://www.docker.com/security/
ZDI Advisory: http://www.zerodayinitiative.com/advisories/ZDI-26-894/

Workarounds (Until Patch Available)

Enable Enhanced Container Isolation (Docker Desktop 4.13+):
- Settings → General → Enable "Use Enhanced Container Isolation"
- This leverages Windows Subsystem for Linux 2 (WSL 2) and Hyper-V isolation
Restrict Docker API Exposure:
- Never expose Docker daemon on TCP 2375 (unencrypted)
- If remote API access is required, use TCP 2376 with TLS mutual authentication
- Bind to localhost only: -H tcp://127.0.0.1:2376
Implement User Access Controls:
- Restrict which users can access the Docker socket (/var/run/docker.sock on Linux, //./pipe/docker_engine on Windows)
- Use rootless mode where possible
Network Segmentation:
- Isolate Docker networks from production VLANs
- Implement egress filtering to prevent C2 callbacks
Extension Audit:
- Remove all non-essential Docker extensions
- Extensions run with elevated privileges and represent a significant attack surface

Long-Term Hardening