Login Request a demo
Medium severity · published Jan 23, 2026
CVE-2026-1386
Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firecracker · Amazon
before 1.13.2; 1.14.0; 1.14.0 · source: NVD
Affected product
FI
Firecracker
Amazon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1386
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-003-AWS/
Product
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2
Product
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1
Vendor Advisory
https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc
More from Firecracker
9.8
CVE-2019-18960
Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0
7.5
CVE-2026-5747
Out-of-bounds Write in Firecracker virtio-pci Transport
7.5
CVE-2020-27174
In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input
5.9
CVE-2020-16843
In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic