CVE-2026-1386

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1386", "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "state": "PUBLISHED", "assignerShortName": "AMZN", "dateReserved": "2026-01-23T20:11:49.349Z", "datePublished": "2026-01-23T20:25:02.188Z", "dateUpdated": "2026-01-23T20:38:50.592Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Firecracker", "vendor": "AWS", "versions": [{"status": "unaffected", "version": "1.13.2"}, {"status": "unaffected", "version": "1.14.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. </p><p>To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.</p>"}], "value": "A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \n\nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above."}], "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132: Symlink Attack"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "shortName": "AMZN", "dateUpdated": "2026-01-23T20:38:50.592Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://aws.amazon.com/security/security-bulletins/2026-003-AWS/"}, {"tags": ["patch"], "url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1"}, {"tags": ["patch"], "url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2"}, {"tags": ["third-party-advisory"], "url": "https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc"}], "source": {"discovery": "UNKNOWN"}, "title": "Arbitrary Host File Overwrite via Symlink in Firecracker Jailer", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:32:52.825461Z", "id": "CVE-2026-1386", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:33:17.735Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T20:32:52.825461Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:33:10.577Z"}}], "cna": {"title": "Arbitrary Host File Overwrite via Symlink in Firecracker Jailer", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132: Symlink Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AWS", "product": "Firecracker", "versions": [{"status": "unaffected", "version": "1.13.2"}, {"status": "unaffected", "version": "1.14.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-003-AWS/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1", "tags": ["patch"]}, {"url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2", "tags": ["patch"]}, {"url": "https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \n\nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.", "supportingMedia": [{"type": "text/html", "value": "<p>A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. </p><p>To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61: UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "shortName": "AMZN", "dateUpdated": "2026-01-23T20:38:50.592Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1386", "state": "PUBLISHED", "dateUpdated": "2026-01-23T20:38:50.592Z", "dateReserved": "2026-01-23T20:11:49.349Z", "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "datePublished": "2026-01-23T20:25:02.188Z", "assignerShortName": "AMZN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Firecracker", "vendor": "AWS", "versions": [{"status": "unaffected", "version": "1.13.2"}, {"status": "unaffected", "version": "1.14.1"}]}], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amazon:firecracker:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5711475-1683-4678-A801-CEE4DD77C20E", "versionEndExcluding": "1.13.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:firecracker:1.14.0:-:*:*:*:*:*:*", "matchCriteriaId": "C1831DAD-F5BB-42AF-8CD4-EA9CD67C1247", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:firecracker:1.14.0:dev:*:*:*:*:*:*", "matchCriteriaId": "0067E934-76C2-4FE3-AA7E-9BD7C8C98135", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \n\nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above."}, {"lang": "es", "value": "Un problema de seguimiento de enlaces simb\u00f3licos de UNIX en el componente jailer en Firecracker versi\u00f3n v1.13.1 y anteriores y 1.14.0 en Linux puede permitir a un usuario local del host con acceso de escritura a los directorios precreados del jailer sobrescribir archivos arbitrarios del host a trav\u00e9s de un ataque de enlace simb\u00f3lico durante la copia de inicializaci\u00f3n al inicio del jailer, si el jailer se ejecuta con privilegios de root.\n\nPara mitigar este problema, los usuarios deben actualizar a la versi\u00f3n v1.13.2 o 1.14.1 o superior."}], "id": "CVE-2026-1386", "lastModified": "2026-06-17T10:15:41.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1386", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:32:52.825461Z", "version": "2.0.3"}}]}, "published": "2026-01-23T21:15:51.397", "references": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "tags": ["Vendor Advisory"], "url": "https://aws.amazon.com/security/security-bulletins/2026-003-AWS/"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "tags": ["Product", "Release Notes"], "url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "tags": ["Product", "Release Notes"], "url": "https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "tags": ["Vendor Advisory"], "url": "https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc"}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}]}

{"bugzilla": {"description": "firecracker: Firecracker jailer: Arbitrary file overwrite via symlink attack", "id": "2432490", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432490"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-61", "details": ["A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.", "A flaw was found in the Firecracker jailer component. A local user with write access to pre-created jailer directories could exploit a symbolic link (symlink) following issue. This vulnerability allows the attacker to overwrite arbitrary host files during the jailer's startup initialization process, provided the jailer is executed with root privileges. This could lead to unauthorized modification of system files."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-1386", "public_date": "2026-01-23T20:25:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-1386\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1386\nhttps://aws.amazon.com/security/security-bulletins/2026-003-AWS/\nhttps://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2\nhttps://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1\nhttps://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc"], "statement": "This vulnerability is rated Moderate for Red Hat. A local host user with write access to pre-created jailer directories can exploit a symbolic link following issue in the Firecracker jailer component. This allows for arbitrary host file overwrite via a symlink attack during jailer startup, provided the jailer is executed with root privileges.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T03:03:49.516224+00:00", "value": {"mitigation_remediation": ["Upgrade to Firecracker v1.13.2, v1.14.1, or a later release that removes the symlink following issue.", "If an upgrade is not immediately possible, run the jailer process as a non\u2011root user or otherwise drop root privileges after the early initialization steps.", "Modify the ownership and file\u2011system permissions of the jailer\u2019s pre\u2011created directories so that regular users have no write access, preventing malicious symlink creation during startup."], "summary": {"action": "Apply Patch", "impact": "Arbitrary Host File Overwrite"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Amazon Firecracker containers running Linux, specifically versions released as v1.13.1 and earlier and the 1.14.0 release. The issue is confined to the jailer component responsible for preparing isolated environments for microVMs on a host system.", "description_and_impact": "A flaw in the Firecracker jailer component allows a locally privileged user who can write to the jailer\u2019s pre\u2011created directories to exploit a symbolic\u2011link following defect during startup initialization. The user can create a symlink that points to any host file, and when the jailer runs with root privileges it copies files through that link, resulting in the unintended overwriting of arbitrary files on the host. This code path is a classic example of CWE\u201161, where insufficient validation of file paths leads to unauthorized file manipulation.", "risk_and_exploitability": "The CVSS v3.1 score of 6.0 indicates a moderate impact. EPSS indicates the exploitation probability is below 1%, and the vulnerability has not been catalogued in the CISA KEV list. The exploit requires local access to a user account with write permissions to the jailer directories and the ability to start the jailer process with elevated privileges. Without these conditions the vulnerability is not exploitable, so the attack vector is largely confined to systems where the host user can control the jailer environment."}}}}, "created": "2026-01-26T11:49:00.215226+00:00", "updated": "2026-04-18T03:15:35.427703+00:00", "vendors": ["amazon", "amazon$PRODUCT$firecracker"]}