← Retour aux CVEs

CVE-2026-1386

MEDIUM

6.0

Description

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

Details CVE

Score CVSS v3.16.0

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie1/23/2026

Derniere modification1/30/2026

Sourcenvd

Observations honeypot0

Produits affectes

amazon:firecracker

Faiblesses (CWE)

CWE-61

References

https://aws.amazon.com/security/security-bulletins/2026-003-AWS/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.