Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-111433

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.

CVSS 3.1 8.6 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-111433

Published

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This issue affects iSulad: through 2.1.6. If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-111433

Published

iSulad

https://atomgit.com/src-openeuler/iSulad

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "openEuler",
                    "product": "iSulad",
                    "platforms": [
                        "Linux"
                    ],
                    "collectionURL": "https://atomgit.com/src-openeuler/iSulad",
                    "packageName": "iSulad",
                    "repo": "https://atomgit.com/openeuler/iSulad",
                    "programFiles": [
                        "src/daemon/modules/spec/specs_mount.c"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "2.1.6",
                            "versionType": "rpm"
                        }
                    ],
                    "defaultStatus": "affected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON