PatchTheCVECVE-2026-53657: Lima launches Linux virtual machines, typically on macOS, for running containerd
CVE-2026-53657 is a high-severity flaw (CVSS 8.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileg
Why this priority
- High severity
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-53657?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-53657 being exploited?
CVE-2026-53657 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-53657 affect?
CVE-2026-53657 affects affected software. Severity is high (CVSS 8.2). Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent i
How urgent is CVE-2026-53657?
Priority 36/100. High severity; On your watchlist
Software pages
macOS vulnerabilities · containerd and runc vulnerabilities · QEMU vulnerabilities