CVE-2026-111433: High severity vulnerability
UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specsmount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.
Event History
Frequently Asked Questions
Which iSulad deployments should be treated as affected?
iSulad versions through 2.1.6 are affected. The issue applies to iSulad running on Linux.
What does an attacker need to exploit this issue?
The attacker must be able to get a victim or the platform to run an attacker-crafted malicious container image. No authenticated iSulad privileges or user interaction are indicated by the provided CVSS vector.
What is the practical impact after exploitation?
During container creation, the iSulad daemon can copy sensitive host directories into an anonymous volume. The resulting container can read the copied host data.