# Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)

> Improper symlink resolution (CWE-59) in the `sbx cp` command of Docker Sandboxes lets an AI agent bypass sandbox file access restrictions to read or overwrite arbitrary host files, including credentials and configuration files. Fixed in v0.51.0.

- **Published:** 2026-11-03T21:28:16Z
- **Last reviewed:** 2026-11-03T21:28:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5178
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5178.png
- **ID:** TL-2026-5178
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-103916, CVE-2026-17106

## Description

CVE-2026-103916 is a path confinement flaw in the `sbx cp` command of the Docker Sandboxes `sbx` CLI (CWE-59, Improper Link Resolution Before File Access). `sbx cp` does not enforce the access restrictions defined by the sandbox's allowlist: file copy operates over a channel separate from the shared virtio-fs workspace mount, and the CLI resolves symbolic links on the host side, with the operator's full permissions, without validating that the final path remains inside the approved workspace. An AI agent running inside a sandbox, or any process able to write into the shared workspace, can therefore plant a symlink and wait for the operator to run a routine `sbx cp`.

Read primitive (copy-in): the agent plants a symlink at a parent directory component of a path in the approved workspace (for example `ln -sfn <host secret dir> <workspace>/vendor`). When the operator runs `sbx cp <workspace>/vendor/notes.txt <sandbox>:/tmp/in/`, the CLI resolves the parent-level symlink on the host and copies a file from outside the workspace into the sandbox, where the agent can read it. Write primitive (copy-out): the agent plants a symlink as the copy destination (for example `<workspace>/results` pointing at a restricted directory). When the operator runs `sbx cp <sandbox>:/tmp/out/notes.txt <workspace>/results/`, the extraction root resolves to the symlink target and sandbox-authored content is written outside the sandbox boundary. Endor Labs documents four symlink positions; three are followed by default and not protected by the `-L` flag (copy-out destination last component, copy-out destination parent component, copy-in source parent component). Only the leaf-level copy-in source is guarded.

High-value host targets named in the research are ~/.aws/credentials, ~/.ssh/id_ed25519, ~/.ssh/authorized_keys, ~/.zshrc and ~/.bash_profile, ~/.gitconfig, .git/hooks/ and node_modules binaries, enabling credential theft, persistence and code execution via config/hook/dependency poisoning. The flaw is a regression-adjacent follow-on to CVE-2026-17106 (CopyEscape), whose sbx cp fix in v0.38.0 contained relative paths but did not validate the extraction root itself. A related error message leaks resolved host paths ("Can't add file <host path> to tar."). NVD lists affected versions as Docker Sandboxes 0.28.0 through 0.50.x on macOS, Linux and Windows; fixed in 0.51.0 (a fix originally scheduled for 0.48.0 on 2026-10-13 was incomplete). The sources describe functional PoCs for both primitives but do not report in-the-wild exploitation or attribution. Exploitation requires operator interaction (a copy command run against a workspace path the agent can influence).

## MITRE ATT&CK

- T1611 Escape to Host
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1565 Data Manipulation
- T1098 Account Manipulation
- T1546 Event Triggered Execution
- T1059 Command and Scripting Interpreter
- T1195 Supply Chain Compromise

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - SPL** (`TL-2026-5178-SPL-002`)

Detects the sbx CLI creating or modifying host files that are classic persistence and code-execution targets: ~/.ssh/authorized_keys, ~/.zshrc, ~/.bash_profile, ~/.bashrc, ~/.gitconfig, ~/.aws/credentials, .git/hooks/* and node_modules/.bin/*. This is the write primitive of CVE-2026-103916 (sbx cp copy-out destination resolving through a planted symlink), enabling SSH persistence, shell-config poisoning, git-hook and dependency poisoning.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1098, T1546, T1565, T1195
- **Data sources:** sysmon_for_linux, edr_file_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="sysmon:linux" EventCode=11 Image="*/sbx" (TargetFilename="*/.ssh/authorized_keys" OR TargetFilename="*/.zshrc" OR TargetFilename="*/.bash_profile" OR TargetFilename="*/.bashrc" OR TargetFilename="*/.gitconfig" OR TargetFilename="*/.aws/credentials" OR TargetFilename="*/.git/hooks/*" OR TargetFilename="*/node_modules/.bin/*")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as written_files by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
| table host User Image count first_seen last_seen written_files
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated', 'FileModified', 'FileRenamed')
| where InitiatingProcessFileName in~ ('sbx', 'sbx.exe')
| where (FileName =~ 'authorized_keys' and FolderPath contains '/.ssh') or FileName in~ ('.zshrc', '.bash_profile', '.bashrc', '.gitconfig') or (FileName =~ 'credentials' and FolderPath contains '/.aws') or FolderPath contains '/.git/hooks' or FolderPath contains '/node_modules/.bin'
| project Timestamp, DeviceName, AccountName, ActionType, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
```

### Sigma

```yaml
title: sbx Process Writes Persistence or Poisoning Target Files (CVE-2026-103916 Write Primitive)
id: 7e2d9a40-1b63-4c85-b0f7-2a4d6c8e9b11
status: experimental
description: Detects the Docker Sandboxes sbx CLI creating or modifying SSH authorized_keys, shell startup files, gitconfig, AWS credentials, git hooks or node_modules binaries on the host. Indicates the copy-out symlink write primitive of CVE-2026-103916 (CWE-59) landing outside the approved workspace.
references:
    - https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916
    - https://github.com/docker/sbx-releases/releases/tag/v0.51.0
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1546
    - attack.impact
    - attack.t1565
    - attack.initial-access
    - attack.t1195
    - cve.2026.103916
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith: '/sbx'
    selection_target_end:
        TargetFilename|endswith:
            - '/.ssh/authorized_keys'
            - '/.zshrc'
            - '/.bash_profile'
            - '/.bashrc'
            - '/.gitconfig'
            - '/.aws/credentials'
    selection_target_contains:
        TargetFilename|contains:
            - '/.git/hooks/'
            - '/node_modules/.bin/'
    condition: selection_proc and 1 of selection_target_*
falsepositives:
    - Operator intentionally copying a dotfile or hook out of a sandbox into the host
level: high
```

**Known false positives:**

- Operator deliberately using sbx cp to copy a dotfile, git hook or node_modules binary out of a sandbox
- Sandbox-driven dependency installs that legitimately populate node_modules/.bin in the workspace

**Tuning notes:** Sysmon for Linux sourcetype assumed; adapt to macOS Endpoint Security or EDR file events. Scope node_modules/.bin and .git/hooks matches to paths outside intentionally mounted workspaces to cut noise, and treat authorized_keys, .zshrc, .bash_profile and .aws/credentials writes as always-alert.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-103916 Docker Sandboxes sbx cp Symlink Plant + Copy (Exploitation) - KQL (locked: unlock with TL Creds)
- CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - KQL (locked: unlock with TL Creds)
- CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - KQL (locked: unlock with TL Creds)
- CVE-2026-103916 Docker Sandboxes sbx cp Symlink Staging (Exploitation) - Sigma (locked: unlock with TL Creds)
- CVE-2026-103916 sbx Process Writing Persistence/Poisoning Targets on Host (Post-Exploitation) - Sigma (locked: unlock with TL Creds)
- CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - Sigma (locked: unlock with TL Creds)
- CVE-2026-103916 Docker Sandboxes sbx cp Symlink Plant + Copy (Exploitation) - SPL (locked: unlock with TL Creds)
- CVE-2026-103916 sbx exec Reading Exfiltrated Host Files in /tmp/in (Credential Access / Exfil Staging) - SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) - Endor Labs (Peyton Kennedy)](https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916)
- [NVD - CVE-2026-103916](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-103916)
- [Docker Sandboxes sbx-releases v0.51.0](https://github.com/docker/sbx-releases/releases/tag/v0.51.0)
- [Docker Sandboxes documentation](https://docs.docker.com/ai/sandboxes/)
- [Docker Sandboxes isolation and security documentation](https://docs.docker.com/ai/sandboxes/security/isolation/)
- [CopyEscape: Taking Over Docker Hosts with docker cp (CVE-2026-17106) - Imperva](https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/)
- [Docker Sandboxes product page](https://www.docker.com/products/docker-sandboxes/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5178