CVE-2026-53657: Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Limato a version that resolves this vulnerability.Fixed in 2.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53657?
CVE-2026-53657 has a high severity rating of 8.2.
How do I fix CVE-2026-53657?
To mitigate CVE-2026-53657, ensure you update Lima to version 2.1.3 or later.
What is the risk associated with CVE-2026-53657?
CVE-2026-53657 has a risk rating of 70, indicating a significant potential impact.
What potential vulnerabilities does CVE-2026-53657 introduce?
CVE-2026-53657 allows an arbitrary user in a QEMU VM to gain root privileges via the guest agent socket.
When was CVE-2026-53657 published?
CVE-2026-53657 was published on July 10, 2026.