# CVE-2026-12539: Docker Sandboxes ICMP egress restriction bypass after daemon restart

> CVE-2026-12539: Docker Sandboxes ICMP egress restriction bypass after daemon restart. CVSS 5.1 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-12539
Last updated: 2026-08-13T14:16:53Z

- Published: 2026-06-18 13:51 UTC · Updated: 2026-08-13 14:16 UTC · Assigner: Docker
- CVSS: 5.1 (CVSS 4.0) · Severity: Medium
- EPSS: 0.14%, 3th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-665, CWE-923

## Description

Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlist.

## Affected vendors and products

- Docker: Docker Sandboxes

## Tracked companies

- [Docker](https://rewindex.com/company/docker.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-12539)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-12539)
- [https://docs.docker.com/ai/sandboxes/](https://docs.docker.com/ai/sandboxes/)
- [https://github.com/docker/sbx-releases/releases/tag/v0.33.0](https://github.com/docker/sbx-releases/releases/tag/v0.33.0)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-12539 · Markdown: https://rewindex.com/cve/CVE-2026-12539.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-12539 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:14:00.214Z