PT-2026-4532 · Amazon · Firecracker

Published 2026-01-23 · Updated 2026-02-18 · CVE-2026-1386

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Firecracker versions prior to 1.13.2 and version 1.14.0

Description A flaw exists in the jailer component of Firecracker that could allow a local host user with write access to pre-created jailer directories to overwrite arbitrary host files. This is possible through a symlink attack during jailer startup initialization if the jailer is run with root privileges.

Recommendations Upgrade to version 1.13.2 or later. Upgrade to version 1.14.1 or later.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-1386

GHSA-36J2-F825-QVGC

Affected Products

Firecracker

References · 11

• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.1 · Patch
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.13.2 · Patch
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-36j2-f825-qvgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1386 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-003-AWS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1386 · Security Note
• https://t.me/CVEtracker/42886 · Telegram Post
• https://twitter.com/alex_pulver/status/2022549554206253205 · Twitter Post
• https://twitter.com/EVEZ666/status/2024267569511661650 · Twitter Post
• https://twitter.com/eyalestrin/status/2015003706207653931 · Twitter Post
• https://twitter.com/CVEnew/status/2014995824728834072 · Twitter Post