CopyEscape Vulnerability in Docker Allows Host File Overwrites and Code Execution

A newly disclosed vulnerability in Docker, tracked as CVE-2026-17106 and nicknamed 'CopyEscape', permits malicious containers to overwrite files on the host system and potentially achieve root code execution. The flaw affects the docker cp command and the sbx cp command, allowing attackers to exploit it through malicious containers. The vulnerability was discovered by the Imperva Red Team and has been assigned a high severity rating due to its potential impact on systems running Docker. Docker has released security updates to mitigate the risk associated with this vulnerability. Organizations using Docker are urged to update their systems to the latest versions immediately. Public proof-of-concept exploit code has also been released, increasing the urgency for remediation.

Key Points: • CVE-2026-17106, nicknamed 'CopyEscape', allows file overwrites and root access. • The vulnerability affects the docker cp and sbx cp commands in Docker. • Docker has released security updates; immediate action is recommended for affected users.