CVE-2026-111433

CVSS 8.6 (high) · published 2026-11-12

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This issue affects iSulad: through 2.1.6. If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.

Weakness: CWE-61

Source: NVD CVE-2026-111433

References

• https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652
• https://atomgit.com/src-openeuler/iSulad/pull/812
• https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.