Docker Sandboxes sbx cp symlink flaw, Endor Labs reports CVE-2026-103916

What happened

Endor Labs researcher Peyton Kennedy reports a vulnerability in Docker Sandboxes, tracked as CVE-2026-103916. According to Endor Labs, the sbx cp command, which copies files between a sandbox and the developer’s computer, does not enforce the folder allowlist that limits what a sandboxed agent can reach. The source for this advisory is the researcher’s own write-up. No other outlet or advisory was available to verify it independently. (Endor Labs)

Endor Labs says the attack works like this (Endor Labs):

• An agent plants a symbolic link inside its read-write workspace.
• Inside the sandbox, that link points nowhere.
• When the operator later runs sbx cp, the CLI resolves the link on the host with the operator’s full permissions and reads or writes the real target.
• The -L flag only governs one of the four positions a symlink can occupy, the last component of a copy-in source. The other three positions are followed by default.

Endor Labs lists two consequences (Endor Labs):

• Read: host files, including cloud credentials and SSH keys, can be pulled into the sandbox.
• Write: host files can be overwritten, which Endor Labs says could allow code to execute outside the sandbox. The write cannot create missing parent directories.

The researcher says an attacker could trigger this through prompt injection, meaning instructions hidden in content the agent processes. Endor Labs does not report any use of the flaw in the wild.

Endor Labs gives the following details (Endor Labs):

• Weakness: CWE-59, Improper Link Resolution Before File Access.
• CVSS 3.1: 8.2, High.
• CVSS 4.0: 7.3, High.
• Fix timeline: Docker first planned a fix for v0.48.0 on October 13, 2026. The fix shipped on November 3, 2026, in v0.51.0.

Endor Labs also says this is separate from an earlier sbx cp copy-out bug, CVE-2026-17106, which was fixed in v0.38.0.

A Docker advisory was not among the sources, so Docker’s own description is not confirmed.

Am I affected?

• Who: you may be affected if you use the standalone Docker Sandboxes sbx CLI and use sbx cp to move files into or out of a sandbox. Endor Labs lists v0.51.0 as the fixed version. The first affected version is not confirmed.
• When: based on Endor Labs’ description, the agent’s symlink only takes effect when an operator runs a copy command against a path inside the granted workspace. Running an agent without using sbx cp is not described as exploitable in the source.
• Exploitation: Endor Labs does not report exploitation in the wild.

What to do now

1. Upgrade the Docker Sandboxes sbx CLI to v0.51.0, the fixed release named by Endor Labs.
2. Until you have upgraded, avoid running sbx cp with host paths inside a workspace an agent can write to. Endor Labs says the -L flag does not protect the destination side or parent directories.
3. If you used sbx cp with agent-writable workspaces on an older version, check those workspaces for unexpected symbolic links. Endor Labs’ reproduction relies on links planted at workspace subdirectories such as a results or vendor folder.

Sources

• Endor Labs: Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916)