Database/Container, Kubernetes & orchestration
Firecracker: Symlink following in the jailer lets a local host user with write access to pre-created jailer
CVSS 6.0CVE-2026-1386Container, Kubernetes & orchestrationcurated
Impact
Symlink following in the jailer lets a local host user with write access to pre-created jailer directories overwrite arbitrary files
Who can reach it
A local host user
What to do
Upgrade Firecracker; tighten jailer directory ownership
References
Related entries
- Firecracker: Network stack freezes under heavy ingressCVE-2020-16843 · FirecrackerMedium
- Firecracker: vsock buffer overflow producing potentially exploitable crashesCVE-2019-18960 · FirecrackerCritical
- Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
- Firecracker: Unbounded serial console buffer growth leaks host memoryCVE-2020-27174 · FirecrackerHigh
- BuildKit: Malicious client or frontend panics the BuildKit daemonCVE-2026-15792 · BuildKitMedium
- CRI-O: an image env entry with no '=' panics the crio daemon and takes down the node's runtimeCVE-2026-17113 · CRI-O container runtime (mergeEnvs / setupContainerEnvironmentAndWorkdir)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.