{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/686f6c61/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["686f6c61"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Docker CLI (\u003c= 29.6.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Docker"],"content_html":"\u003cp\u003eCVE-2026-17106 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability located in the tar extraction logic of the Docker CLI (version 29.6.1 and earlier). The flaw is specific to the client-side CLI tool and is triggered during the execution of 'docker cp' from a container. An attacker can manipulate file access patterns within a compromised container to win a race condition against the Docker daemon. By replacing a directory with an absolute symlink while the tar file is being processed, an attacker can force the Docker CLI to extract subsequent files outside of the intended destination directory, effectively granting arbitrary write access to the host filesystem. On Linux hosts, this can be weaponized to overwrite binaries such as '/usr/bin/runc', leading to full command execution with root privileges on the host during subsequent container lifecycle events. This vulnerability was addressed in Docker CLI 29.7.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker deploys a malicious container using a library (e.g., LD_PRELOAD) to intercept system calls and mask a directory as a regular file.\u003c/li\u003e\n\u003cli\u003eThe malicious container creates a large 'decoy' file (e.g., 16 MiB) to force the Docker daemon to take significant time during tar production.\u003c/li\u003e\n\u003cli\u003eThe attacker monitors 'docker cp' access patterns using 'inotify' within the container to detect when the daemon initiates the file read process.\u003c/li\u003e\n\u003cli\u003eUpon detecting the daemon access, the attacker executes an atomic 'rename(2)' operation to replace the 'escape/' directory with an absolute symlink pointing to a sensitive location on the host (e.g., /usr/bin).\u003c/li\u003e\n\u003cli\u003eThe daemon completes the tar production, now including the attacker's symlink and subsequent payload files.\u003c/li\u003e\n\u003cli\u003eThe vulnerable Docker CLI client processes the tar file, creating the symlink on the host filesystem at the specified destination.\u003c/li\u003e\n\u003cli\u003eThe Docker CLI continues extracting files through the newly created symlink, writing the payload into the target host directory.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary file write, or specifically overwrites '/usr/bin/runc' to gain host-level code execution as root.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a containerized process to escape its isolation and write arbitrary files to the host filesystem with the permissions of the user executing the 'docker cp' command. In high-privilege scenarios, such as when the Docker CLI is run by a root user, this vulnerability enables complete host system compromise, including the ability to overwrite critical system binaries like 'runc'.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Docker CLI on all development, CI/CD, and administrator workstations to version 29.7.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit administrative workflows that utilize 'docker cp' to interact with untrusted or externally sourced container images.\u003c/li\u003e\n\u003cli\u003eRestrict container execution privileges using security profiles (e.g., AppArmor, Seccomp) to limit the ability of containers to interact with internal Docker socket or CLI-related files.\u003c/li\u003e\n\u003cli\u003eMonitor file integrity on critical host paths like '/usr/bin' for unexpected modifications associated with 'docker cp' activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T18:23:48Z","date_published":"2026-08-12T18:23:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-docker-cli-toctou/","summary":"A TOCTOU race condition in Docker CLI versions 29.6.1 and earlier allows malicious containers to perform arbitrary file writes on the host filesystem via the 'docker cp' command.","title":"CVE-2026-17106: TOCTOU Race Condition in Docker CLI","url":"https://feed.craftedsignal.io/briefs/2026-08-docker-cli-toctou/"}],"language":"en","title":"CraftedSignal Threat Feed - 686f6c61","version":"https://jsonfeed.org/version/1.1"}