DOCKER COPYESCAPE VULNERABILITY ENABLES HOST FILE OVERWRITE AND ROOT CODE EXECUTION

Summary from the TLDR InfoSec newsletter

CopyEscape (CVE-2026-17106) is a critical race condition in the ⁠docker cp⁠ command that allows a malicious container to escape its boundaries and overwrite arbitrary files on the host system. By swapping a directory for a symlink during the archive-copy workflow, attackers can force extraction to outside paths, achieving root code execution by overwriting critical host binaries like ⁠/usr/bin/runc⁠. Docker has patched the vulnerability in Engine 29.7.2 and Desktop 4.86.0, requiring defenders to upgrade immediately, halt automated root-level copy operations, and ensure untrusted containers are stopped before retrieving files.