Symlink Following Vulnerability in iSulad by openEuler
CVE-2026-111433

8.6HIGH

Key Information:

Vendor

Openeuler

Status
Isulad
Vendor
CVE Published:
12 November 2026

What is CVE-2026-111433?

A symlink following vulnerability exists in the iSulad daemon by openEuler, allowing attackers to exploit crafted malicious images. When executed, the daemon may inadvertently copy sensitive host directories into an anonymous volume during container creation. This oversight enables unauthorized access to potentially sensitive data from the host system. The vulnerability is traced back to the program file src/daemon/modules/spec/specs_mount.c, affecting all versions of iSulad prior to 2.1.6.

Affected Version(s)

iSulad Linux 0 <= 2.1.6

References

https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b5...
patch
https://atomgit.com/src-openeuler/iSulad/pull/812
patch

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tianyu Tu
.