CVE-2026-95614: Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zenitel Connectto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local write access to the hiatus application container filesystem. The shared data volume then allows a crafted rsyslog configuration to be consumed by the host configuration watcher.
What level of access can successful exploitation provide?
Successful exploitation allows arbitrary OS command execution as root on the host operating system. The impact includes compromise of confidentiality, integrity, and availability for both the vulnerable system and subsequent systems.
Which versions are affected?
Zenitel Connect versions before 1.11.0 are affected. Version 1.11.0 is not identified as affected by the provided information.
What should be prioritized if immediate updating is not possible?
Restrict write access to the hiatus container filesystem, because that access is required to place the crafted rsyslog configuration on the shared data volume. Review and limit local access paths to the container and shared volume.