CopyEscape Docker Vulnerability Lets Malicious Containers Overwrite Host Files and Gain Root

Cybersecuritynews •Guru Baran • August 11, 2026

A newly disclosed Docker vulnerability, tracked as CVE-2026-17106 and nicknamed “CopyEscape,” allows malicious containers to overwrite files on the host machine and, in certain configurations, achieve full root code execution. The flaw was discovered by the Imperva Red Team and affects the widely used docker cp command, along with the related sbx cp command used […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Docker Vulnerability CVE-2026-17106 Allows Host File Overwrite A critical vulnerability in Docker, identified as CVE-2026-17106 and dubbed 'CopyEscape', has been disclosed. This flaw allows malicious containers to overwrite files on the host system using the 'docker cp' command, potentially leading to code execution with the privileges of the user running the command. The vulnerability affects systems running Docker Engine, Docker CLI, Docker Desktop, and Docker Sandboxes. Public proof-of-concept exploit code has been released, raising concerns about active exploitation. Affected organizations are urged to update to the latest versions of Docker to mitigate risks. The flaw was discovered by the Imperva Red Team and is linked to unsafe symlink handling during extraction. Successful exploitation could compromise developer accounts or achieve root access. Security updates have been released to address this vulnerability. 4 sources 73

Extracted Entities

CopyEscape Docker Vulnerability Lets Malicious Containers Overwrite Host Files and Gain Root

The full story

Extracted Entities

CVEs (1)

Tools (1)

Vulnerabilities (1)