CVE-2026-1386

unknowncovered by 1 sourcefirst seen 2026-06-05

Bulletin ID: 2026-003-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/23 12:30 PM PST Description: Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services. Firecracker runs in user space and uses the Linux Kernel-based Virtual Machine (KVM) to create microVMs. Each Firecracker microVM is further isolated with common Linux user-space security barriers by a companion program called "jailer". The jailer provides a second line of defense in case a user escapes from the microVM boundaries and it is released at each Firecracker version. We are aware of CVE-2026-1386, an issue that is related to the Firecracker jailer, which under certain circumstances can allow an user to overwrite arbitrary files in the host filesystem. AWS services that use Firecracker are not impacted by the issue as we appropriately restrict access to the host and the jailer folder, blocking the preconditions required for the attack to happen. Impacted versions: Firecracker version v1.13.1 and earlier and 1.14.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

What: An issue in the Firecracker jailer may allow users to overwrite arbitrary files in the host filesystem.
Who is affected: Users of Firecracker technology.
Urgency: Remediation is important to prevent potential file overwrites.
Action: Review and apply updates to the Firecracker jailer.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-1386

Get an email if CVE-2026-1386 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-1386 - Arbitrary Host File Overwrite via Symlink in Firecracker Jaileraws · 2026-06-05

External references

NVD record for CVE-2026-1386

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-1386 status](https://www.csirts.com/badge/CVE-2026-1386)](https://www.csirts.com/cve/CVE-2026-1386)