CVE-2026-1386 - Arbitrary Host File Overwrite via Symlink in Firecracker Jailer

unknownCVE-2026-1386

Bulletin ID: 2026-003-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/23 12:30 PM PST Description: Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services. Firecracker runs in user space and uses the Linux Kernel-based Virtual Machine (KVM) to create microVMs. Each Firecracker microVM is further isolated with common Linux user-space security barriers by a companion program called "jailer". The jailer provides a second line of defense in case a user escapes from the microVM boundaries and it is released at each Firecracker version. We are aware of CVE-2026-1386, an issue that is related to the Firecracker jailer, which under certain circumstances can allow an user to overwrite arbitrary files in the host filesystem. AWS services that use Firecracker are not impacted by the issue as we appropriately restrict access to the host and the jailer folder, blocking the preconditions required for the attack to happen. Impacted versions: Firecracker version v1.13.1 and earlier and 1.14.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: AWS product: FirecrackerOther

What: An issue in the Firecracker jailer may allow users to overwrite arbitrary files in the host filesystem.
Who is affected: Users of Firecracker technology.
Urgency: Remediation is important to prevent potential file overwrites.
Action: Review and apply updates to the Firecracker jailer.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Firecracker

Get an email when a new Firecracker advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-003-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-13860.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-1386	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Arbitrary Host

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-57230: OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and anal…nvd · 2026-07-10
unknownCVE-2026-55881: OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob retur…nvd · 2026-07-10
highCVE-2026-55880: OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and n…nvd · 2026-07-10
criticalCVE-2026-55879: OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tr…nvd · 2026-07-10
unknownCVE-2026-45203: Kernel software installed and running inside a Host VM may post improper commands to the GPU F…nvd · 2026-07-10
unknownCVE-2026-45196: Kernel software installed and running inside a Host VM may post improper commands to the GPU F…nvd · 2026-07-10