Notice on the Docker File CopyEscape Vulnerability (CVE-2026-17106)
CVE-2026-17106 (CopyEscape) is a high-risk vulnerability in Docker. During the execution the docker cp command, the Docker CLI does not effectively verify the dynamically changing file structure when processing container archive data and extracting files. Attackers can exploit the file system race condition (Time-Of-Check to Time-Of-Use, TOCTOU for short) in combination with unsafe symlink handling to bypass path security checks and write or overwrite files to arbitrary locations on the host.
Description
| Type | CVE-ID | Severity | Discovered |
|---|---|---|---|
| Container escape | CVE-2026-17106 | High | 2026-8-10 |
Vulnerability Exploitation Conditions
An attacker can exploit one of these vulnerabilities when the following conditions are met:
- The attacker can control the file system inside the container (for example, by constructing a malicious image or executing code inside the container).
- A user or automated process on the host runs the docker cp command on a running container controlled by the attacker.
Impact
When the above exploitation conditions are met, the container process may escape to the host node, leading to node information leakage or denial of service.
Identification Method
Log in to the CCE console, click the name of the target cluster to access the cluster console, and check the cluster version on the Overview page.
If the cluster version is v1.30.14-r110, v1.31.14-r70, v1.32.13-r40, v1.33.12-r20, v1.34.8-r20, v1.35.5-r20, or earlier than v1.36.2-r10, and the container runtime configured for the node or node pool is Docker, the risk may exist.
Solution
Workarounds:
- Ensure that the container image source is trusted. Use only trusted images from official repositories and avoid deploying containers from unknown image sources to reduce the risk of attacks.
- Do not run docker cp on untrusted containers: Do not copy data from running containers whose source is unknown.
- Restrict the use of the sudo docker cp or avoid using root to run the copy command to prevent attackers from exploiting the vulnerability to run with elevated privileges.
Rectification methods:
- Method 1: Reset the nodes and select containerd as the container runtime. For details, see Changing the Container Runtime from Docker to containerd.
- Method 2: We will launch a new version to fix this vulnerability. Pay attention to CCE Patch Release Notes and upgrade your clusters to a version that has these vulnerabilities fixed. For clusters that have reached EOS, upgrade them to versions under maintenance.
