CVE-2026-53657 Details
Description
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
A vulnerability in Lima versions prior to 2.1.3 allows an arbitrary user in a Linux virtual machine (VM) running with the QEMU driver to access the guest agent socket. When the guest agent is enabled, this access can be exploited to execute arbitrary commands with root privileges within the VM. The vulnerability arises because the guest agent socket tunnels addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue does not affect the VZ driver, as the guest agent uses vsocks instead of Unix sockets.
Users can upgrade to Lima version 2.1.3 or later to address this vulnerability. On macOS hosts, the VZ driver can be used instead of QEMU, or the guest agent can be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lima-vm/lima/commit/8a45892378d22f40505c31a38f786a07701b6d50 | [email protected] | Source CodeVendor |
| https://github.com/lima-vm/lima/commit/b08cae8a670cf916d5da11c48a6de76dabd89678 | [email protected] | Source CodeVendor |
| https://github.com/lima-vm/lima/releases/tag/v2.1.3 | [email protected] | Release NotesVendor |
| https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lima | <= 2.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |