Apache Storm Logviewer follows worker symlinks across ACLs (CVE-2026-124495)
A topology submitter can read other users' worker logs and other files the Logviewer process can read.
Stories per day · 30 days
2 RSS
15 stories, newest first · one card per story
Stories tagged #symlink
HashiCorp Nomad symlink escape and Boundary SSRF disclosed
Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.
Major rsync upgrade in Debian because of 33 CVEs
Debian bumps rsync to 3.5.0 on Trixie to fix 33 CVEs, with breaking security changes.
Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files
Docker patches CopyEscape (CVE-2026-17106), which lets malicious containers overwrite host files during docker cp via a symlink race, potentially enabling root code execution.
12
[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
USN-8287-2: XDG Desktop Portal regression
Ubuntu fixes an incomplete XDG Desktop Portal patch for CVE-2026-40354 that broke file trashing.
CVE-2026-82331: Apache BuildStream: tar source extraction escape
CVE-2026-82331 lets malicious BuildStream tar sources write files on the host via symlinks.
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
1
Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Docker patched two sandbox-escape flaws, CVE-2026-77179 and CVE-2026-79994, letting malicious guest workloads access host files and sockets.
Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files
Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.
4
ZDI-26-705: (0Day) BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
ZDI disclosed an unpatched symlink directory traversal flaw (CVE-2026-92205, CVSS 6.1) in BusyBox libarchive enabling arbitrary file creation.
Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
Unsanitised topology.blobstore.map local names in Apache Storm enable path traversal writes on supervisors as the supervisor user.
iceener/files-stdio-mcp-server: sandbox escape in fs_search via a symlinked directory (recursive walker validates only the top level)
iceener/files-stdio-mcp-server allows a read-side sandbox escape: fs_search follows symlinked directories while the recursive walker validates confinement only at the top level.
Survey of filesystem MCP servers: how the "sandboxed filesystem" boundary is enforced (one breach, four defended-by-design)
Survey finds one filesystem MCP server vulnerable to a symlink-based sandbox escape while four others are defended by design.