{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T00:38:16.054","vulnerabilities":[{"cve":{"id":"CVE-2026-1386","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-01-23T21:15:51.397","lastModified":"2026-06-17T10:15:41.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A UNIX symbolic link following issue in the jailer component in Firecracker version  v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. \n\nTo mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above."},{"lang":"es","value":"Un problema de seguimiento de enlaces simbólicos de UNIX en el componente jailer en Firecracker versión v1.13.1 y anteriores y 1.14.0 en Linux puede permitir a un usuario local del host con acceso de escritura a los directorios precreados del jailer sobrescribir archivos arbitrarios del host a través de un ataque de enlace simbólico durante la copia de inicialización al inicio del jailer, si el jailer se ejecuta con privilegios de root.\n\nPara mitigar este problema, los usuarios deben actualizar a la versión v1.13.2 o 1.14.1 o superior."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"AWS","product":"Firecracker","defaultStatus":"unaffected","versions":[{"version":"1.13.2","status":"unaffected"},{"version":"1.14.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T20:32:52.825461Z","id":"CVE-2026-1386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-61"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:amazon:firecracker:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.2","matchCriteriaId":"F5711475-1683-4678-A801-CEE4DD77C20E"},{"vulnerable":true,"criteria":"cpe:2.3:a:amazon:firecracker:1.14.0:-:*:*:*:*:*:*","matchCriteriaId":"C1831DAD-F5BB-42AF-8CD4-EA9CD67C1247"},{"vulnerable":true,"criteria":"cpe:2.3:a:amazon:firecracker:1.14.0:dev:*:*:*:*:*:*","matchCriteriaId":"0067E934-76C2-4FE3-AA7E-9BD7C8C98135"}]}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-003-AWS/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Vendor Advisory"]},{"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Product","Release Notes"]},{"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Product","Release Notes"]},{"url":"https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Vendor Advisory"]}]}}]}