[SECURITY] Block Dangerous Docker Volume Mounts (V-012, CVSS 8.7) #64

allegro · 2026-03-30T23:55:48Z

allegro commented

2026-03-30 23:55:48 +00:00

Prevent container escape via Docker socket mount.

Block docker.sock, /proc, /sys, /dev mounts
Validate all user-configured volumes
Log security errors for dangerous volumes

Refs: V-012, CWE-250

Prevent container escape via Docker socket mount. - Block docker.sock, /proc, /sys, /dev mounts - Validate all user-configured volumes - Log security errors for dangerous volumes Refs: V-012, CWE-250

allegro added 1 commit 2026-03-30 23:55:48 +00:00

security: block dangerous Docker volume mounts (V-012, CVSS 8.7)

Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 28s

Details

Tests / test (pull_request) Failing after 29s

Details

Docker Build and Publish / build-and-push (pull_request) Failing after 42s

Details

ed32487cbe

Prevent privilege escalation via Docker socket mount.

Changes:
- tools/environments/docker.py: Add _is_dangerous_volume() validation
- Block docker.sock, /proc, /sys, /dev, root fs mounts
- Log security error when dangerous volume detected

Fixes container escape vulnerability where user-configured volumes
could mount Docker socket for host compromise.

CVSS: 8.7 (High)
Refs: V-012 in SECURITY_AUDIT_REPORT.md
CWE-250: Execution with Unnecessary Privileges

allegro merged commit cf1afb07f2 into main

2026-03-30 23:55:51 +00:00

allegro referenced this issue from a commit

2026-03-30 23:55:52 +00:00

Merge pull request '[SECURITY] Block Dangerous Docker Volume Mounts (V-012, CVSS 8.7)' (#64) from security/fix-docker-privilege into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#64