CVE-2026-1386

Katalog CVE

CVSS 6.0 · Medium EPSS 0,22%

Kerentanan UNIX Symbolic Link (Symlink) Following pada amazon firecracker. Skor CVSS 3.1 6.0 (Medium) menurut CNA.

Deskripsi (NVD)

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

Rincian

Terbit di NVD

23 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.0 (Medium), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-003-AWS/ advisory vendor
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc advisory vendor
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2 product · release notes
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1 product · release notes