CVE-2026-1386

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1386
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1386.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1386
Aliases
  • GHSA-36j2-f825-qvgc
Published
2026-01-23T21:15:51.397Z
Modified
2026-03-15T14:14:43.911863Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.

To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

References

Affected packages

Git / github.com/firecracker-microvm/firecracker

Affected ranges

Type
GIT
Repo
https://github.com/firecracker-microvm/firecracker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f75548ca7322ba13743f10614b30b846b8dd025f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1253957af578c72a73993a972167f1e732080f46
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1253957af578c72a73993a972167f1e732080f46
Fixed
37593df439aeb19fc70b292e618770108e563e7e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.0-dev"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.10.0
v0.10.1
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.26-wip
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.10.0-dev
v1.11.0-dev
v1.12.0-dev
v1.13.0-dev
v1.14.0
v1.14.0-dev
v1.2.0
v1.5.0-dev
v1.6.0-dev
v1.7.0-dev
v1.8.0-dev
v1.9.0-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1386.json"