CVE-2026-17106
Record summary
EIP currently links 3 repository PoCs to CVE-2026-17106.
Exploitation context
Available material
- Repository PoCs
- 3
Proofs of concept
3Repository PoCs
GitHubmasasron/CopyEscape-CVE-2026-17106Repository PoCby masasronStars: 13Exploit11 files
Analysis
Technical assessment
The artifact is a proof-of-concept exploit for CVE-2026-17106 that uses a TOCTOU race condition in Docker's `docker cp` to write arbitrary files outside the intended destination on the host. It includes two complete exploit implementations: a Linux variant that overwrites `/usr/bin/runc` with a malicious script, and a macOS variant that creates a marker file in the user's home directory.
Backdoor review
No backdoor observed in reviewed code
The repository is a proof-of-concept exploit for CVE-2026-17106. All code serves the documented purpose of demonstrating a Docker cp TOCTOU vulnerability. The Linux monitor writes a replacement /usr/bin/runc and the macOS monitor writes ~/pwnd, both as described in the README. No concealed backdoor, unrelated payload, or operator-directed harm beyond the stated exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact contains complete, functional code that exercises the vulnerability to achieve unauthorized file writes on the host. The Linux monitor.c writes a malicious script to /usr/bin/runc (line 123) and the macOS monitor.c writes a marker to ~/pwnd (line 148). The README explicitly describes these as demonstrations that 'overwrites /usr/bin/runc' and 'creates ~/pwnd', which are exploitation actions, not mere detection.
README.md:15-17linux/monitor.c:123macos/monitor.c:148Requirements
- A vulnerable Docker Engine or Docker Desktop release (tested against Docker Engine/CLI 29.6.1 and Docker Desktop 4.81.0).
README.md:26-33 - A running Docker daemon and Docker CLI access.
README.md:27-28 - Root privileges for the Linux variant that overwrites /usr/bin/runc.
README.md:29
Observed behavior
- The Linux exploit monitor (monitor.c) sets up a directory layout with a staged symlink pointing to /usr/bin, then uses inotify to detect when Docker accesses a trigger file during `docker cp`. It races the archive creation by atomically replacing a directory with the symlink, causing the Docker CLI to follow the symlink and write a malicious payload to /usr/bin/runc.
linux/monitor.c:117-131linux/monitor.c:133-146linux/monitor.c:148-226 - The macOS exploit monitor (monitor.c) similarly races `docker cp` to create a symlink to the user's home directory, causing the CLI to write a marker file (~/pwnd) outside the intended copy destination.
macos/monitor.c:142-156macos/monitor.c:158-171macos/monitor.c:173-251 - Both exploits use an LD_PRELOAD library (watched_preload.c) to hide the underlying directory structure from processes inside the container, making /watched/file.txt appear as a regular file.
linux/watched_preload.c:31-37macos/watched_preload.c:31-37
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Linux monitor writes a replacement /usr/bin/runc script that creates /imperva_red_teamMatches the documented Linux PoC behavior in README.md lines 15-17 and 130-136
linux/monitor.c:123README.md:15-17 - Exploit Behavior
- macOS monitor writes ~/pwnd with contents COPYESCAPE_MACOS_DEMOMatches the documented macOS PoC behavior in README.md lines 13-14 and 57-65
macos/monitor.c:148README.md:13-14 - Exploit Mechanism
- LD_PRELOAD library redirects file operations on /watched/file.txt to a backing fileUsed to hide the directory nature of /watched/file.txt from container processes, as described in README.md lines 161-166
linux/watched_preload.c:31-36README.md:161-166
What the analysis did not establish
- Three files (likely Dockerfiles and build scripts) are omitted from the evidence due to text budget constraints, but the core exploit logic in the C source files and shell scripts is fully included.
- The evidence does not include the compiled binaries; analysis is based solely on the provided source code.
- Three files (likely Dockerfiles or build artifacts) were omitted from the text evidence; their content was not reviewed, but metadata indicates no binary payloads.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubHackSpeak/CVE-2026-17106Repository PoCby HackSpeakStars: 1Exploit12 files
Analysis
Technical assessment
The artifact is a complete exploit for CVE-2026-17106 (CopyEscape), a Docker `docker cp` arbitrary file write vulnerability. It contains C source code implementing a TOCTOU race condition attack using inotify and symlink pivoting, along with shell scripts to build and run the exploit in Docker containers targeting macOS and Linux hosts.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-17106 (CopyEscape). All reviewed source code and scripts implement the documented TOCTOU race condition to demonstrate arbitrary file write via 'docker cp'. The Linux variant targets /usr/bin/runc, and the macOS variant targets ~/pwnd, exactly as described in the README. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact contains complete, compilable C code (monitor.c) that actively exploits a TOCTOU race condition to achieve arbitrary file write outside the container, along with shell scripts that build and execute the attack. This is code intended to exercise a vulnerability, not merely detect or report it.
linux/monitor.c:1-233macos/monitor.c:1-259macos/demo-macos.sh:1-88Requirements
- A vulnerable version of Docker (e.g., Engine/CLI 29.6.1, Desktop 4.81.0) must be installed on the host.
README.md:18-19 - The attacker must be able to build and run a malicious Docker container on the target host.
macos/demo-macos.sh:54-60 - The user must execute `docker cp` from the malicious container to the host.
macos/demo-macos.sh:74-75
Observed behavior
- The exploit sets up a directory layout inside the container with a regular file, a large trigger file, and a pre-staged symlink pointing to a host target directory.
linux/monitor.c:117-131macos/monitor.c:142-156 - A monitor process uses inotify to detect when `docker cp` accesses the trigger file, then performs a rename-based symlink pivot to replace a directory with the pre-staged symlink.
linux/monitor.c:148-225macos/monitor.c:173-250 - The TOCTOU race causes `docker cp` to follow the symlink and write files to an attacker-chosen location on the host (e.g., `/usr/bin/runc` on Linux or `~/pwnd` on macOS).
README.md:11-14linux/monitor.c:23-24macos/monitor.c:60-62 - The Linux variant overwrites `/usr/bin/runc` with a malicious script that creates a marker file, enabling subsequent root code execution.
linux/monitor.c:123 - The macOS variant creates a file `~/pwnd` in the user's home directory as a proof of successful exploitation.
macos/monitor.c:148macos/demo-macos.sh:80-83
Behaviors behind the backdoor verdict
Observables
- Exploit Target
- /usr/bin/runc (Linux) and ~/pwnd (macOS)The PoC overwrites these files to demonstrate the vulnerability, consistent with the README description.
linux/monitor.c:23-24macos/monitor.c:60-62 - Exploit Mechanism
- TOCTOU symlink race via inotify and directory renameThe monitor programs use inotify to detect 'docker cp' access and perform a directory swap to redirect writes outside the container, matching the CVE description.
linux/monitor.c:133-146macos/monitor.c:158-171 - File Redirection
- LD_PRELOAD library redirects /watched/file.txt to /watched/.file.txt.regularThe preload library hides the symlink directory from the container's own view, a necessary part of the PoC setup.
linux/watched_preload.c:31-37macos/watched_preload.c:31-37
What the analysis did not establish
- The evidence packet reports 4 unclassified files (binary or other) that were not provided as text; their content is unknown.
- The evidence packet reports complete_artifact_coverage is false; 4 of 12 total files were omitted from the text selection.
- The CVE record for CVE-2026-17106 was absent from the acquired CVEList V5 dataset, so no authoritative CVE description is available for cross-reference.
- 4 text files were omitted from the evidence packet due to size constraints; their content was not reviewed.
- Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED), though none were identified in the inventory.
- The review is limited to the supplied static source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHub686f6c61/POC-CopyEscape-CVE-2026-17106Repository PoCby 686f6c61Stars: 0Exploit8 files
Analysis
Technical assessment
The artifact is a Proof of Concept (PoC) exploit for CVE-2026-17106, a TOCTOU race condition in Docker's `docker cp` command. It includes a shell script runner (`run-poc.sh`) that orchestrates building a malicious container image, running it, and triggering the vulnerable `docker cp` operation to achieve arbitrary file write on the host. The README describes the full exploitation chain, including LD_PRELOAD-based file camouflage, inotify-based race condition monitoring, and symlink pivot to write a marker file (`~/pwnd`) outside the intended destination.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, Dockerfile, and runner script for a proof-of-concept exploit (CVE-2026-17106). The README explicitly describes the exploit chain, its educational purpose, and the destructive Linux variant. The Dockerfile builds the PoC components, and the runner script automates downloading a vulnerable Docker CLI, building the image, and running the exploit. All observed behavior is consistent with the stated purpose of demonstrating the CVE; no concealed backdoor, unrelated payload, or operator-directed harm beyond the described exploit was found.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, executable script (`run-poc.sh`) that automates the exploitation of CVE-2026-17106 by building and running a malicious container, then triggering the vulnerable `docker cp` command to write a file to an arbitrary host location. The README explicitly describes the code as a 'PoC' that demonstrates the exploitation chain, and the script's primary operation is to exercise the vulnerability, not merely detect it.
README.md:1-3run-poc.sh:1-2run-poc.sh:126-127Requirements
- Docker Desktop running on macOS with a vulnerable Docker CLI version (29.6.1 or earlier).
README.md:25README.md:113 - The user's HOME directory must follow the pattern /Users/<username>.
run-poc.sh:50-53 - The runner script downloads a specific vulnerable Docker CLI binary from the official Docker website.
run-poc.sh:56-63
Observed behavior
- Downloads a vulnerable Docker CLI binary (version 29.6.1) if not already present.
run-poc.sh:56-63 - Builds a Docker image containing a monitor and LD_PRELOAD library designed to exploit the race condition.
run-poc.sh:67-70Dockerfile:1-49 - Runs the malicious container and waits for it to set up a camouflaged file structure.
run-poc.sh:96-104 - Executes the vulnerable `docker cp` command to copy a file from the container to the host, triggering the race condition.
run-poc.sh:126-127 - Checks for the creation of a marker file (`~/pwnd`) on the host, indicating successful arbitrary file write.
run-poc.sh:135-137
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- The PoC exploits a TOCTOU race condition in docker cp to write a file outside the intended destination on the host.This is the normal, documented behavior of the CVE-2026-17106 proof-of-concept.
README.md:25-34run-poc.sh:125-132 - Destructive Capability
- The Linux variant overwrites /usr/bin/runc to achieve code execution as root on the host.This is explicitly warned about in the README and is part of the documented exploit chain, not a hidden backdoor.
README.md:34README.md:46 - External Download
- The runner script downloads a vulnerable Docker CLI binary from download.docker.com.This is necessary for the PoC to work against a patched Docker installation and is clearly documented.
run-poc.sh:31run-poc.sh:56-63
What the analysis did not establish
- Only 3 of 8 files in the repository were provided as text; the C source files (monitor.c, watched_preload.c) and entrypoint.sh are not included, so the internal exploit logic cannot be fully verified.
- The evidence packet reports complete_artifact_coverage is false, indicating the full artifact is not present.
- The CVE record for CVE-2026-17106 was absent from the acquired CVEList, so the vulnerability details could not be independently confirmed from that source.
- The evidence packet includes only README.md, Dockerfile, and run-poc.sh. The C source files (monitor.c, watched_preload.c) and entrypoint.sh are omitted, so their contents could not be reviewed for hidden behavior.
- Five additional files in the repository are omitted from the evidence, and their contents are unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.