{"id":"CVE-2026-1386","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1386","generatedAt":"2026-10-28T06:13:32.648Z","title":"A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a…","description":"A UNIX symbolic link following issue in the jailer component in Firecracker version  v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \n\nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.","published":"2026-01-23T21:15:51.000Z","lastModified":"2026-06-17T10:15:41.000Z","status":"Analyzed","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","cvss":{"version":"4.0","score":6,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-61"],"affected":["amazon/firecracker"],"epss":{"score":0.00214,"percentile":0.11666,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-003-AWS/","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2","tags":["Product","Release Notes"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1","tags":["Product","Release Notes"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc","tags":["Vendor Advisory"],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1386","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}