What's wrong with this entry?
Docker commands now reject --host, --context, --config, and --tls flags, as well as short flags -H and -c, which could be used to redirect Docker operations to a remote daemon and escape the sandbox.
Docker flag validation (search for startsWith("--host") near the docker command validator)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.