What is the CVSS score of CVE-2026-1386?

CVE-2026-1386 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Firecracker are affected by CVE-2026-1386?

Organizations using the jailer component in Firecracker should be aware of moderate risk from CVE-2026-1386 rated CVSS 6.0. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-1386?

Within 30 days: Identify affected systems running the jailer component in Firecracker and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Firecracker CVE-2026-1386

MEDIUM

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-01-23 ff89ba41-3aa1-4d27-914a-91399e9639e5

Linux Firecracker Red Hat Suse

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

SUSE

3.1 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Red Hat

6.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 21:15 nvd

MEDIUM 6.0

DescriptionCVE.org

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.

To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.

AnalysisAI

Firecracker contains a vulnerability that allows attackers to a local host user with write access to the pre-created jailer directories to ove (CVSS 6.0).

Technical ContextAI

exists in the jailer component. A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges.

To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.