{"id":12038,"date":"2026-08-12T12:41:39","date_gmt":"2026-08-12T18:41:39","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-87-copyescape-vulnerability-in-docker\/"},"modified":"2026-09-29T17:00:13","modified_gmt":"2026-09-29T23:00:13","slug":"alert-2026-87-copyescape-vulnerability-in-docker","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/","title":{"rendered":"Alert 2026-87 CopyEscape Vulnerability in Docker"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>moby\/go-archive prior to 0.3.0.<\/li>\n\n\n\n<li>Docker Desktop prior to 4.86.0.<\/li>\n\n\n\n<li>Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">A security vulnerability identified as <strong>CVE-2026-17106<\/strong>, named <strong>CopyEscape<\/strong>, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker cp command.<\/p>\n\n<p class=\"wp-block-paragraph\">The vulnerability was discovered by researchers from <strong>Imperva Red Team<\/strong> and allows a container controlled by an attacker to manipulate the file copying process to cause Docker to write or overwrite files outside the directory originally selected by the user.<\/p>\n\n<p class=\"wp-block-paragraph\">The flaw occurs within the TAR extraction process used by Docker. When a copy operation from a container is executed, the Docker daemon generates a TAR file based on the container&#8217;s file system and sends it to the Docker CLI, which subsequently extracts it on the host system.<\/p>\n\n<p class=\"wp-block-paragraph\">CopyEscape mainly combines two conditions:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>A race condition in the container&#8217;s file system that allows the generation of an inconsistent TAR file.<\/li>\n\n\n\n<li>A flaw during extraction that allows following symbolic links to locations outside the target directory.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">As a result, a malicious container can cause the Docker CLI to write files to arbitrary locations on the host system using the privileges of the user or process that executed docker cp.<\/p>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\">Administrators are recommended to perform the following actions:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Update <strong>Docker Engine and Docker CLI to 29.7.2 or higher<\/strong>.<\/li>\n\n\n\n<li>Update <strong>Docker Desktop to 4.86.0 or higher<\/strong>.<\/li>\n\n\n\n<li>Update <strong>Docker Sandboxes to 0.38.0 or higher<\/strong>.<\/li>\n\n\n\n<li>Ensure the use of moby\/go-archive 0.3.0 or later when used directly by internal applications.<\/li>\n\n\n\n<li>Update Docker on developer workstations.<\/li>\n\n\n\n<li>Prioritize CI\/CD runners that execute docker cp operations.<\/li>\n\n\n\n<li>Review automations that run Docker via sudo or as the root user.<\/li>\n\n\n\n<li>Apply the principle of least privilege to users running Docker CLI.<\/li>\n\n\n\n<li>Avoid using sudo docker cp unless strictly necessary.<\/li>\n\n\n\n<li>Do not copy files from untrusted or compromised containers directly to sensitive systems.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Additional information:<\/h2>\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.imperva.com\/blog\/copyescape-taking-over-docker-hosts-with-docker-cp\/\" target=\"_blank\" rel=\"noreferrer noopener\">Imperva Threat Research \u2013 CopyEscape: Taking Over Docker Hosts with docker cp<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-17106\" target=\"_blank\" rel=\"noreferrer noopener\">CVE Program \u2013 CVE-2026-17106<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.docker.com\/desktop\/release-notes\/\" target=\"_blank\" rel=\"noreferrer noopener\">Docker Desktop Release Notes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.docker.com\/engine\/release-notes\/\" target=\"_blank\" rel=\"noreferrer noopener\">Docker Engine Release Notes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/release-notes\/\" target=\"_blank\" rel=\"noreferrer noopener\">Docker Sandboxes Release Notes<\/a><\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-12038","publicacion","type-publicacion","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-12T18:41:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-29T23:00:13+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#listItem\",\"name\":\"Alert 2026-87 CopyEscape Vulnerability in Docker\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-87 CopyEscape Vulnerability in Docker\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/\",\"name\":\"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab\",\"description\":\"Affected product(s): moby\\\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-87-copyescape-vulnerability-in-docker\\\/#breadcrumblist\"},\"datePublished\":\"2026-08-12T12:41:39-06:00\",\"dateModified\":\"2026-09-29T17:00:13-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab","description":"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#listItem","name":"Alert 2026-87 CopyEscape Vulnerability in Docker"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#listItem","position":2,"name":"Alert 2026-87 CopyEscape Vulnerability in Docker","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/","name":"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab","description":"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/#breadcrumblist"},"datePublished":"2026-08-12T12:41:39-06:00","dateModified":"2026-09-29T17:00:13-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab","og:description":"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/","og:image":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","og:image:secure_url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","article:published_time":"2026-08-12T18:41:39+00:00","article:modified_time":"2026-09-29T23:00:13+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alert 2026-87 CopyEscape Vulnerability in Docker - Beacon Lab","twitter:description":"Affected product(s): moby\/go-archive prior to 0.3.0. Docker Desktop prior to 4.86.0. Docker Sandboxes prior to 0.38.0 for the sbx cp host copy functionality. Description A security vulnerability identified as CVE-2026-17106, named CopyEscape, has been disclosed. It affects the mechanism used by Docker to copy files from a container to the host system via the docker","twitter:image":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png"},"aioseo_meta_data":{"post_id":"12038","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-29 22:59:22","updated":"2026-09-29 23:00:13","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-87 CopyEscape Vulnerability in Docker\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-87 CopyEscape Vulnerability in Docker","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-87-copyescape-vulnerability-in-docker\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12038\/revisions"}],"predecessor-version":[{"id":12039,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12038\/revisions\/12039"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}