CVE-2026-17106: how the CopyEscape flaws in docker cp let a container reach the host

Imperva's red team published CVE-2026-17106 on 11 August 2026, describing two weaknesses that combine in docker cp. The Docker Engine and CLI below 29.7.2, Docker Desktop below 4.86.0 and Docker Sandboxes below 0.38.0 are affected. The CVSS score is 7.1. No in-the-wild exploitation had been confirmed at publication, and the technical details and proof-of-concept code were released.

The two halves of the flaw

The first weakness lives on the container side. While the daemon builds a tar stream to hand back, code inside the container can rename a file or swap a directory for a symbolic link, opening a timing gap between the check and the use. The second weakness lives in the CLI extractor, which validates the destination path and then follows symbolic links when writing. The daemon believes it is returning a file from the container, and the client writes to whatever the link points at on the host.

The impact depends on privilege. On macOS, the copy runs as the logged-in user, so the outcome is code execution in that user's context. On Linux, running docker cp with sudo gives an attacker the ability to overwrite root-owned files, and replacing a binary such as runc turns the primitive into root code execution. The distinction is worth stating plainly because it changes the priority of the fix on the two platforms.

Practical checks

• Upgrade Docker Engine and CLI to 29.7.2 or later, Docker Desktop to 4.86.0 or later, and Docker Sandboxes to 0.38.0 or later.
• Avoid copying files out of containers that run untrusted or third-party images, and treat any such copy as a privileged operation.
• Stop using sudo docker cp as a routine step in scripts. Where it remains necessary, keep it on a dedicated management host away from production credentials.
• Review scripts and CI jobs that copy artefacts out of containers, since those are the places the technique would be used without a human noticing.

The interesting part of this research is where it sits. Docker cp is a convenience command that operators run daily, and CI pipelines invoke it unattended. A flaw in a convenience path is easier to overlook in a review than a flaw in the network stack, which is why the mitigation list here is mostly about habits rather than about firewalls.