MikroTik RouterOS CVE-2026-89021

The container package (container.npk) must be installed and active on the RouterOS device - devices without this optional package have no /container/add endpoint and cannot be reached via this vulnerability. The attacker requires router administrator-level credentials (CVSS PR:H) to invoke the container import function; standard read-only or limited accounts cannot reach this path. A human administrator must actively trigger the container import action (CVSS UI:P / SSVC automatable: no), making mass automated exploitation infeasible. The attack fires at import time before the container starts, so even organizations that import but never run containers are exposed. Devices running the 7.23.x LTS branch remain permanently exposed until migrated to 7.24.x, as no LTS fix exists.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:P/PR:H/UI:P) is a reasonable representation of realistic risk and notably lower than a naive reading of 'root-level file write' would suggest. Three factors constrain exploitability: PR:H (router administrator credentials required), UI:P (an admin must actively import the image), and AT:P (the container package must be installed). SSVC concurs - exploitation status is none, automatable is no (cannot be mass-triggered without human admin interaction), and technical impact is partial. There is no CISA KEV listing and no public proof-of-concept code at time of analysis. The most credible threat vectors are supply-chain attack (malicious image hosted in a registry the admin trusts) or insider threat. The most significant risk amplifier is the unpatched LTS branch: organizations pinned to 7.23.x have no vendor-provided fix and must either migrate to 7.24.2 or remove the container package entirely. EPSS data was not included in the provided intelligence and cannot be assessed.

An attacker targeting an organization that runs RouterOS with the container package enabled crafts an OCI container image containing tar archive members with symlinks resolving to host paths such as RouterOS user configuration or persistent script directories. The attacker delivers the image to an administrator - via a poisoned registry, spear-phishing link, or supply-chain compromise - and induces them to import it via the RouterOS container interface. Upon container/add execution, the extractor follows the symlinks and writes attacker-controlled files to the host partition under root context without starting the container, achieving persistence or credential manipulation. No public proof-of-concept code exists at time of analysis, though the tar-slip technique is broadly published in container security literature.