Digital.Nhs.Uk

Critical Docker Vulnerability CVE-2026-17106 Allows Host File Overwrite

First seen 11 Aug 2026, 20:12 UTC • •72.8

Article Content

1 / 5

Browse articles

ThreatCluster •August 12, 2026 at 20:05 UTC

•CVE-2026-17106 allows arbitrary file overwrite and potential code execution.
•Affected systems include Docker Engine, CLI, Desktop, and Sandboxes.
•Public proof-of-concept exploit code has been released, increasing risk.

A critical vulnerability in Docker, identified as CVE-2026-17106 and dubbed 'CopyEscape', has been disclosed. This flaw allows malicious containers to overwrite files on the host system using the 'docker cp' command, potentially leading to code execution with the privileges of the user running the command. The vulnerability affects systems running Docker Engine, Docker CLI, Docker Desktop, and Docker Sandboxes. Public proof-of-concept exploit code has been released, raising concerns about active exploitation. Affected organizations are urged to update to the latest versions of Docker to mitigate risks. The flaw was discovered by the Imperva Red Team and is linked to unsafe symlink handling during extraction. Successful exploitation could compromise developer accounts or achieve root access. Security updates have been released to address this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 49d ago How this analysis works

Timeline

2026-08-11

CVE-2026-17106 disclosed

The vulnerability was publicly disclosed, allowing malicious containers to overwrite host files and potentially gain root access.

2026-08-11

Public proof-of-concept released

Technical analysis and proof-of-concept details for exploiting CVE-2026-17106 were made public, raising concerns about active exploitation.

2026-08-11

Docker releases security updates

Docker released updates for Docker Engine, CLI, Desktop, and Sandboxes to address CVE-2026-17106.

Cybersecuritynews

2026-08-12

Security advisory issued

Organizations using affected Docker versions are urged to update to the latest versions to mitigate the vulnerability.

More articles in this cluster (4)

Threat Graph

12 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Vulnerability (2)

CVE-2026-17106
CopyEscape

Weakness (2)

CWE-362 - Race Condition
CWE-59 - Improper Link Resolution Before File Access

Affected Platform (5)

Docker CLI
Docker Desktop
Docker Engine
Docker Sandboxes
Linux

Tool (1)

Docker

Relationships

Docker exploits CVE-2026-17106
Docker exploits CopyEscape
CVE-2026-17106 targets Docker CLI
CVE-2026-17106 targets Docker Desktop
CVE-2026-17106 targets Docker Engine
CVE-2026-17106 targets Docker Sandboxes
CopyEscape targets Docker CLI
CopyEscape targets Docker Desktop
CopyEscape targets Docker Engine
CopyEscape targets Docker Sandboxes
Zero-day Exploit targets Docker CLI
Zero-day Exploit targets Docker Desktop
Zero-day Exploit targets Docker Engine
Zero-day Exploit targets Docker Sandboxes
T1068 - Exploitation for Privilege Escalation targets Docker CLI
T1068 - Exploitation for Privilege Escalation targets Docker Desktop
T1068 - Exploitation for Privilege Escalation targets Docker Engine
T1068 - Exploitation for Privilege Escalation targets Docker Sandboxes
CVE-2026-17106 related to CWE-362 - Race Condition
CVE-2026-17106 related to CWE-59 - Improper Link Resolution Before File Access
CVE-2026-17106 related to Linux

Following this threat?

Track CVE-2026-17106 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…