This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| openEuler | iSulad | affected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 12 Nov 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This issue affects iSulad: through 2.1.6. If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read. | |
| Weaknesses | CWE-61 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: openEuler
Published:
Updated: 2026-11-12T03:45:51.294Z
Reserved: 2026-10-16T02:50:14.526Z
Link: CVE-2026-111433
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-12T04:17:17.160
Modified: 2026-11-12T04:17:17.160
Link: CVE-2026-111433
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-61
UNIX Symbolic Link (Symlink) Following