CVE-2026-53657
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.20%
- CWE
- CWE-276, CWE-668
- Published
- 2026-07-10
- Last modified
- 2026-07-14
Affected products
- lima-vm lima
Weakness type
Related vulnerabilities
- CVE-2026-11813 — A potential improper permissions vulnerability was reported in the Lenovo Filez Client application...
- CVE-2026-52766 — YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
- CVE-2026-77393 — Inductive Automation Ignition Incorrect Default Permissions
- CVE-2026-81302 — PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a...
- CVE-2026-9634 — Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-9633 — Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-81682 — openssl_encrypt before 1.4.9 Insecure File Permissions
- CVE-2026-69665 — SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If...