Vulnerability record · CVE-2026-1386 · published 23 January 2026

CVE-2026-1386: Amazon firecracker vulnerability

Amazon · Firecracker

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

6.0 CVSS 4.0 Medium EPSS 0.22% · top 89.1% CWE-61 · CWE-61

6.0CVSS 4.0 base score

0.22%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Firecracker Amazon

References

Link	Tags
https://aws.amazon.com/security/security-bulletins/2026-003-AWS/	Vendor Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2	ProductRelease Notes
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1	ProductRelease Notes
https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc	Vendor Advisory

Track CVE-2026-1386 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18960Amazon firecracker classic buffer overflow vulnerabilityFirecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.EPSS 3.3%11 Dec 2019 8.7CVE-2026-5747Amazon firecracker divide by zero vulnerabilityAn out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local gu…EPSS 0.21%8 Apr 2026 7.5CVE-2020-27174Amazon firecracker memory leak vulnerabilityIn Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sen…EPSS 1.7%16 Oct 2020 5.9CVE-2020-16843Amazon firecracker vulnerabilityIn Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial o…EPSS 1.7%4 Aug 2020 8.5CVE-2026-54420LiteSpeed cPanel plugin symlink following on shared hostingThe LiteSpeed cPanel plugin before 2.4.8 (and LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks supplied by a user who has FTP or web shell ac…KEVEPSS 0.81%analysed14 Jun 2026 9.8CVE-2025-58360GeoServer WMS GetMap XXE allows unauthenticated file read and SSRFGeoServer versions 2.26.0 through 2.26.2 and before 2.25.6 accept XML input at the /geoserver/wms GetMap endpoint without sufficiently restricting ex…KEVEPSS 61%analysed25 Nov 2025 9.8CVE-2025-2776SysAid On-Prem unauthenticated XXE in Server URL processingSysAid On-Prem versions up to 23.3.40 process the Server URL without restricting XML external entities, so an unauthenticated attacker can supply cra…KEVEPSS 64%analysed7 May 2025 7.5CVE-2025-2775SysAid On-Prem unauthenticated XXE in Checkin processingSysAid On-Prem versions up to 23.3.40 process Checkin XML without restricting external entities, so an unauthenticated attacker can supply a crafted …KEVEPSS 43%analysed7 May 2025

Source: NIST National Vulnerability Database (record CVE-2026-1386), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.