CVE-2026-53657: Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
Impact On an instance of Lima running with qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled.
This could result in running an arbitrary command with the root privileges in the VM (not on the host), as lima-guestagent.sock provides the tunneling service for an arbitrary address, including a Unix socket address for privileged daemons like D-Bus.
This vulnerability is not exploitable on vz driver, as the guest agent uses vsocks instead of Unix sockets.
Patches Patched in Lima v2.1.3 (8a45892378d22f40505c31a38f786a07701b6d50)
[!NOTE] The default user account in the VM can still run an arbitrary command as the root via the guest agent socket. This is not a vulnerability, as the user can already run an arbitrary command with sudo by design.
Workarounds - On macOS hosts, use vz driver instead of qemu (limactl create --vm-type=vz. Default since v1.0.) - Or, disable the guest agent (limactl create --plain)
Other sources
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lima-vm/lima/v2to a version that resolves this vulnerability.Fixed in 2.1.3 - Upgrade
Upgrade
Limato a version that resolves this vulnerability.Fixed in 2.1.3Patch 8a45892378d22f40505c31a38f786a07701b6d50 - Configuration
If you must use the `qemu` driver on macOS, disable the guest agent by creating the instance with `limactl create --plain`, noting that the default user in the VM can still run an arbitrary command as root via the guest agent socket.
Lima (qemu guest agent) guest agent enabled = disabled - Compensating control
If using Lima on macOS, create the instance with the `vz` driver instead of `qemu` (e.g., `limactl create --vm-type=vz`), because the guest agent on `vz` uses vsocks instead of Unix sockets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53657?
CVE-2026-53657 has a high severity rating of 8.2.
How do I fix CVE-2026-53657?
To mitigate CVE-2026-53657, ensure you update Lima to version 2.1.3 or later.
What is the risk associated with CVE-2026-53657?
CVE-2026-53657 has a risk rating of 70, indicating a significant potential impact.
What potential vulnerabilities does CVE-2026-53657 introduce?
CVE-2026-53657 allows an arbitrary user in a QEMU VM to gain root privileges via the guest agent socket.
When was CVE-2026-53657 published?
CVE-2026-53657 was published on July 10, 2026.