Imperva’s Red Team disclosed CVE-2026-17106, nicknamed CopyEscape, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. A container under attacker control — or simply running untrusted code — can turn a routine file copy into a write primitive against the host filesystem, and in privileged or automated setups, that write primitive escalates to full root code execution. The same underlying flaw also affects sbx cp, the equivalent command used by Docker Sandboxes for AI-agent workflows.

What happened

docker cp looks like an ordinary file copy, but it isn’t one under the hood. When you run docker cp container:/path/to/file ./file, the Docker daemon walks the requested path inside the container, packages the result into a tar archive, and streams that archive back to the CLI, which extracts it into the destination directory on the host. The container supplies the archive’s contents; the host-side CLI just trusts the archive and extracts it.

CopyEscape chains two weaknesses in that pipeline. First, a filesystem race lets a container that’s still running produce an inconsistent tar archive — the daemon can be tricked into archiving a path that changes between the stat check and the tar write. Second, an extraction flaw lets the CLI follow a symlink planted inside that archive out of the intended destination directory. Combined, a malicious container can direct the extraction step to write files anywhere the user running docker cp has filesystem access — overwriting shell configuration (.bashrc, .profile), SSH configuration (authorized_keys), executables on $PATH, source code, or CI persistence mechanisms.

Why it escalates to root

The write primitive alone is bad enough — silent, attacker-controlled file overwrite on the host. But Imperva demonstrated the more serious outcome: on Linux, if the copy target is a binary that Docker itself later invokes with elevated privileges, replacing that binary turns the write into code execution as root. Their PoC targets runc, the low-level container runtime Docker shells out to — overwrite it via CopyEscape, then trigger any operation that invokes runc, and the attacker’s payload runs as root on the host.

This risk compounds anywhere docker cp runs outside a human’s direct attention: CI/CD pipelines that copy build artifacts out of containers, backup/log-collection scripts, and any workflow where an administrator or automation account runs docker cp with sudo. Docker Sandboxes — increasingly used to isolate AI-agent code execution — inherit the same flaw through sbx cp, meaning an agent-controlled sandbox that gets to choose what it puts on disk can potentially reach outside its box.

Who’s affected

Any environment using docker cp or sbx cp against containers or sandboxes that aren’t fully trusted is exposed: shared CI runners, managed container platforms, backup tooling, and AI-agent sandboxing setups built on Docker Sandboxes. Disclosure began in April 2026 and required multiple fix iterations after an earlier patch attempt introduced regressions — a sign the archive-extraction logic wasn’t trivial to close safely.

Mitigation

  1. Upgrade. Docker Engine and CLI 29.7.2+, Docker Desktop 4.86.0+, and Docker Sandboxes 0.38.0+ all carry the fix. This is the only real remediation.
  2. Stop the container before copying. A stopped container can’t win the race that produces an inconsistent archive — treat docker cp against a running container as inherently riskier until patched.
  3. Eliminate sudo docker cp. Any workflow invoking docker cp with elevated privileges converts an arbitrary-file-write into a direct root-escalation path; strip privilege from copy operations wherever possible.
  4. Don’t copy from untrusted or live containers. Retrieve data from suspicious or adversary-controlled containers only inside isolated, disposable environments you’re prepared to discard.
  5. Audit CI and automation. Search pipelines and scripts for docker cp / sbx cp invocations that run unattended against containers built from untrusted input, and prioritize those for the version upgrade.

Docker’s advisory and the Imperva writeup have the full technical breakdown, including the archive-race and symlink-following mechanics: Imperva: CopyEscape — Taking Over Docker Hosts with docker cp and NHS England Digital advisory CC-4828.