Docker Desktop 4.86.0 Patches a Container Path-Escape Flaw
The release fixes CVE-2026-17106, a destination-escape vulnerability in docker container cp, alongside Swarm networking and shutdown fixes.
Docker released Desktop version 4.86.0 on August 10, 2026, with a security fix as its most significant change: CVE-2026-17106, described as a destination-escape flaw in `docker container cp`, the command used to copy files between a running container and the host filesystem. A flaw in how a copy destination path is validated could, under some conditions, let a copy operation write outside the directory a user intended, which is the kind of bug that matters most on shared or multi-tenant hosts.
The same release also introduced Docker VMM Beta performance improvements, Docker's newer virtual machine manager for running containers on Mac and Windows, and fixed a bug where containers could fail to respect their configured stop timeout or restart policy specifically during Docker Engine shutdown — a scenario that could otherwise leave containers in an inconsistent state after a host reboot or Desktop restart.
Networking and platform-specific fixes rounded out the release: port forwarding for Swarm services was corrected, a Linux ARM64 issue with QEMU binary path resolution was resolved, and Docker addressed the underlying Swarm networking path that the fix depended on.
Docker discloses vulnerabilities like this one through its own security announcements page and assigns each a CVE identifier, following the same coordinated-disclosure practice used across most major container tooling. Docker Desktop's automatic update mechanism means most users receive fixes like this one without needing to track individual CVEs themselves.
Docker Desktop ships fixes on a rolling basis — 4.86.0 was followed within the same month by 4.87.0 and 4.88.0, each carrying its own smaller set of fixes — rather than batching most changes into a single, less frequent release. The full, versioned history of every release, including CVE references where applicable, is maintained on Docker's own documentation site, which is also where Docker publishes advance notice of any breaking changes to Desktop's configuration or defaults.