CVE-2026-1386 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with wr…
Medium CVSS: 6.0

CVE-2026-1386

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.

To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.
Vendor
Amazon
Product
Firecracker
CWE
CWE-61
Yayın Tarihi
2026-01-23 21:15:51
Güncelleme
2026-01-30 16:57:56
Source Identifier
ff89ba41-3aa1-4d27-914a-91399e9639e5
KEV Date Added
-

Kategoriler

CWE-61 Firecracker MEDIUM Amazon 2026

Referanslar

https://aws.amazon.com/security/security-bulletins/2026-003-AWS/ https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2 https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1 https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc