Bulletin ID: 2026-003-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 2026/01/23 12:30 PM PST
 

Description:

Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services. Firecracker runs in user space and uses the Linux Kernel-based Virtual Machine (KVM) to create microVMs. Each Firecracker microVM is further isolated with common Linux user-space security barriers by a companion program called "jailer". The jailer provides a second line of defense in case a user escapes from the microVM boundaries and it is released at each Firecracker version.

We are aware of CVE-2026-1386, an issue that is related to the Firecracker jailer, which under certain circumstances can allow an user to overwrite arbitrary files in the host filesystem.

AWS services that use Firecracker are not impacted by the issue as we appropriately restrict access to the host and the jailer folder, blocking the preconditions required for the attack to happen.

Impacted versions: Firecracker version v1.13.1 and earlier and 1.14.0

Resolution:

This issue has been addressed in Firecracker version v1.14.1 and v1.13.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

If users are unable to upgrade to Firecracker version v1.14.1 or v1.13.2, we recommend protecting the jailer folder using UNIX user permissions to restrict their access to only trusted users with these example commands.

     chown <trusted user> <jail folder path>
     chmod 700 <jail folder path>

References:

• CVE-2026-1386
• GHSA-36j2-f825-qvgc

Acknowledgement:

We would like to thank an Independent Security Researcher for collaborating on this issue through the coordinated vulnerability disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.