Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)

Key facts for Docker Sandboxes symlink escape

Detection coverage for Docker Sandboxes symlink escape

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5178 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - SPL

Detects the sbx CLI creating or modifying host files that are classic persistence and code-execution targets: ~/.ssh/authorized_keys, ~/.zshrc, ~/.bash_profile, ~/.bashrc, ~/.gitconfig, ~/.aws/credentials, .git/hooks/* and node_modules/.bin/*. This is the write primitive of CVE-2026-103916 (sbx cp copy-out destination resolving through a planted symlink), enabling SSH persistence, shell-config poisoning, git-hook and dependency poisoning.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1098, T1546, T1565, T1195
• Data sources: sysmon_for_linux, edr_file_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="sysmon:linux" EventCode=11 Image="*/sbx" (TargetFilename="*/.ssh/authorized_keys" OR TargetFilename="*/.zshrc" OR TargetFilename="*/.bash_profile" OR TargetFilename="*/.bashrc" OR TargetFilename="*/.gitconfig" OR TargetFilename="*/.aws/credentials" OR TargetFilename="*/.git/hooks/*" OR TargetFilename="*/node_modules/.bin/*")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as written_files by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
| table host User Image count first_seen last_seen written_files

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated', 'FileModified', 'FileRenamed')
| where InitiatingProcessFileName in~ ('sbx', 'sbx.exe')
| where (FileName =~ 'authorized_keys' and FolderPath contains '/.ssh') or FileName in~ ('.zshrc', '.bash_profile', '.bashrc', '.gitconfig') or (FileName =~ 'credentials' and FolderPath contains '/.aws') or FolderPath contains '/.git/hooks' or FolderPath contains '/node_modules/.bin'
| project Timestamp, DeviceName, AccountName, ActionType, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: sbx Process Writes Persistence or Poisoning Target Files (CVE-2026-103916 Write Primitive)
id: 7e2d9a40-1b63-4c85-b0f7-2a4d6c8e9b11
status: experimental
description: Detects the Docker Sandboxes sbx CLI creating or modifying SSH authorized_keys, shell startup files, gitconfig, AWS credentials, git hooks or node_modules binaries on the host. Indicates the copy-out symlink write primitive of CVE-2026-103916 (CWE-59) landing outside the approved workspace.
references:
    - https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916
    - https://github.com/docker/sbx-releases/releases/tag/v0.51.0
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1546
    - attack.impact
    - attack.t1565
    - attack.initial-access
    - attack.t1195
    - cve.2026.103916
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith: '/sbx'
    selection_target_end:
        TargetFilename|endswith:
            - '/.ssh/authorized_keys'
            - '/.zshrc'
            - '/.bash_profile'
            - '/.bashrc'
            - '/.gitconfig'
            - '/.aws/credentials'
    selection_target_contains:
        TargetFilename|contains:
            - '/.git/hooks/'
            - '/node_modules/.bin/'
    condition: selection_proc and 1 of selection_target_*
falsepositives:
    - Operator intentionally copying a dotfile or hook out of a sandbox into the host
level: high

Known false positives:

• Operator deliberately using sbx cp to copy a dotfile, git hook or node_modules binary out of a sandbox
• Sandbox-driven dependency installs that legitimately populate node_modules/.bin in the workspace

Tuning notes: Sysmon for Linux sourcetype assumed; adapt to macOS Endpoint Security or EDR file events. Scope node_modules/.bin and .git/hooks matches to paths outside intentionally mounted workspaces to cut noise, and treat authorized_keys, .zshrc, .bash_profile and .aws/credentials writes as always-alert.

• 🔒 CVE-2026-103916 Docker Sandboxes sbx cp Symlink Plant + Copy (Exploitation) - KQL · unlock with TL Creds
• 🔒 CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - KQL · unlock with TL Creds
• 🔒 CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - KQL · unlock with TL Creds
• 🔒 CVE-2026-103916 Docker Sandboxes sbx cp Symlink Staging (Exploitation) - Sigma · unlock with TL Creds
• 🔒 CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - Sigma · unlock with TL Creds
• 🔒 CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - Sigma · unlock with TL Creds
• 🔒 CVE-2026-103916 Docker Sandboxes sbx cp Symlink Plant + Copy (Exploitation) - SPL · unlock with TL Creds
• 🔒 CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - SPL · unlock with TL Creds

Indicators of compromise for Docker Sandboxes symlink escape

As of 2026-11-03, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5178.

How Docker Sandboxes symlink escape works

CVE-2026-103916 is a path confinement flaw in the `sbx cp` command of the Docker Sandboxes `sbx` CLI (CWE-59, Improper Link Resolution Before File Access). `sbx cp` does not enforce the access restrictions defined by the sandbox's allowlist: file copy operates over a channel separate from the shared virtio-fs workspace mount, and the CLI resolves symbolic links on the host side, with the operator's full permissions, without validating that the final path remains inside the approved workspace. An AI agent running inside a sandbox, or any process able to write into the shared workspace, can therefore plant a symlink and wait for the operator to run a routine `sbx cp`.

Read primitive (copy-in): the agent plants a symlink at a parent directory component of a path in the approved workspace (for example `ln -sfn <host secret dir> <workspace>/vendor`). When the operator runs `sbx cp <workspace>/vendor/notes.txt <sandbox>:/tmp/in/`, the CLI resolves the parent-level symlink on the host and copies a file from outside the workspace into the sandbox, where the agent can read it. Write primitive (copy-out): the agent plants a symlink as the copy destination (for example `<workspace>/results` pointing at a restricted directory). When the operator runs `sbx cp <sandbox>:/tmp/out/notes.txt <workspace>/results/`, the extraction root resolves to the symlink target and sandbox-authored content is written outside the sandbox boundary. Endor Labs documents four symlink positions; three are followed by default and not protected by the `-L` flag (copy-out destination last component, copy-out destination parent component, copy-in source parent component). Only the leaf-level copy-in source is guarded.

High-value host targets named in the research are ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.ssh/authorized_keys, ~/.zshrc and ~/.bash_profile, ~/.gitconfig, .git/hooks/ and node_modules binaries, enabling credential theft, persistence and code execution via config/hook/dependency poisoning. The flaw is a regression-adjacent follow-on to CVE-2026-17106 (CopyEscape), whose sbx cp fix in v0.38.0 contained relative paths but did not validate the extraction root itself. A related error message leaks resolved host paths ("Can't add file <host path> to tar."). NVD lists affected versions as Docker Sandboxes 0.28.0 through 0.50.x on macOS, Linux and Windows; fixed in 0.51.0 (a fix originally scheduled for 0.48.0 on 2026-10-13 was incomplete). The sources describe functional PoCs for both primitives but do not report in-the-wild exploitation or attribution. Exploitation requires operator interaction (a copy command run against a workspace path the agent can influence).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter

Persistence

T1098 Account Manipulation; T1546 Event Triggered Execution

Initial Access

T1195 Supply Chain Compromise

Credential Access

T1552 Unsecured Credentials

Impact

T1565 Data Manipulation

Privilege Escalation

T1611 Escape to Host

Remediation for Docker Sandboxes symlink escape

Patches

• Docker Sandboxes v0.51.0: sbx cp blocks symlinks in mounted directories from escaping to other host paths, contains the copy-out destination root, applies -L logic to all components of copy-in source paths and prints resolved paths on copy

Immediate actions

• Upgrade Docker Sandboxes (sbx CLI) to v0.51.0 or later
• Treat agent-proposed `sbx cp` commands with heightened scrutiny and do not copy to/from workspace paths an agent has been able to modify
• Check resolved paths before copying, e.g. `realpath <workspace path>` must stay within the workspace

Workarounds

• Validate paths manually with realpath before each copy
• Avoid copying to/from paths the agent has ever mounted
• Do not trust parent-level symlinks; check every path component

Longer-term hardening

• Audit workspaces mounted into sandboxes for planted symlinks at any path component before running copy operations
• Keep host credential and config files (~/.aws, ~/.ssh, shell rc files, ~/.gitconfig) outside any directory mounted into an agent sandbox
• Rotate AWS and SSH credentials if an agent-influenced `sbx cp` may have touched them

Affected and fixed versions

• Docker — Docker Sandboxes (sbx CLI)
  Vulnerable versions: 0.28.0 through 0.50.x (all versions before 0.51.0)
  Fixed in: 0.51.0

Timeline of Docker Sandboxes symlink escape

• 2026-04-11 Imperva reports the related CopyEscape flaw (later CVE-2026-17106) in docker cp / locked-ioc-9 cp to Docker
• 2026-07-24 CVE-2026-17106 assigned for the earlier locked-ioc-9 cp copy-out destination escape
• 2026-08-06 Docker Sandboxes 0.38.0 released, fixing the locked-ioc-9 cp destination escape under CVE-2026-17106; the fix did not validate the extraction root itself
• 2026-08-10 CopyEscape (CVE-2026-17106) publicly disclosed by Imperva alongside Docker Desktop 4.86.0 release
• 2026-10-13 Initial fix for the symlink issue scheduled for v0.48.0 but delayed; Docker later identified the patch as incomplete
• 2026-11-03 CVE-2026-103916 published (NVD) and Endor Labs (Peyton Kennedy) publishes technical analysis with read and write PoCs
• 2026-11-03 Docker Sandboxes v0.51.0 released with locked-ioc-9 cp symlink containment fix

Sources cited for Docker Sandboxes symlink escape

• NVD - CVE-2026-103916 NVD (NIST) · Advisory · 2026-11-03
• Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) - Endor Labs (Peyton Kennedy) endorlabs.com · Research · 2026-11-03
• Docker Sandboxes documentation docs.docker.com · Vendor report · 2026-11-03
• Docker Sandboxes isolation and security documentation docs.docker.com · Vendor report · 2026-11-03
• CopyEscape: Taking Over Docker Hosts with docker cp (CVE-2026-17106) - Imperva imperva.com · Research · 2026-08-10
• Docker Sandboxes product page docker.com · Vendor report · 2026-11-03
• Docker Sandboxes sbx-releases v0.51.0 GitHub · Code repository · 2026-11-03

More in vulnerability

• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)
• CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)