VulnSocial

CVE-2026-53657Disclosure

LOWCVSS 8.2 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-276CWE-668

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-01); latest day: 2
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-06-19: 1Mentions · 2026-07-01: 2Mentions · 2026-07-10: 2PoC Mentioned / Linked · 2026-07-01: 2Patch / Workaround · 2026-06-19: 1Patch / Workaround · 2026-07-10: 1Technical Details · 2026-07-01: 206-1907-0107-10
Signal classification2 categories
Disclosure
360.0%
Patch
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-191
Patch1
2026-07-012
Disclosure2
2026-07-102
Disclosure1Patch1
Full discourse5 posts
  • /r/netsec@_r_netsec
    Disclosure

    Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657) https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/

    Post summary

    The blog post announces a privilege‑escalation vulnerability (CVE-2026-53657) in Lima QEMU guests caused by a world‑writable agent socket, providing technical details but no exploit code, active exploitation evidence, or patch information.

    0401341.5K
    33.7K followersView on X
  • Nicolas Krassas@Dinosn
    Disclosure

    Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657) https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/

    Post summary

    A disclosure of a new privilege escalation vulnerability (CVE‑2026‑53657) affecting Lima QEMU guests via a world‑writable agent socket, with a blog post providing technical details, but no exploit tools, patches, or active exploitation evidence are mentioned.

    011332.5K
    160.8K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-53657 Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary us… https://www.cve.org/CVERecord?id=CVE-2026-53657 ----- Traducción: CVE-2026-53657 Lim… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-53657 affecting Lima’s qemu driver on macOS before version 2.1.3, but gives no PoC, exploit, or patch details.

    0000042
    91 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-53657 Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary us… https://www.cve.org/CVERecord?id=CVE-2026-53657

    Post summary

    CVE-2026-53657 impacts Lima prior to release 2.1.3 and is addressed in that version; no PoC, exploit, or active attack details are provided.

    00000617
    57.8K followersView on X
  • Miso Poop@misop00p
    Patch

    Spent some time digging around @TheLimaProject and ended up reporting a security issue. CVE-2026-53657 is fixed now. Appreciate the maintainers for handling it. Details: https://github.com/lima-vm/lima/security/advisories/GHSA-2j9v-p4xj-cjw2 #LimaVM #CVE #InfoSec

    Post summary

    The author reported CVE‑2026‑53657 to TheLimaProject; maintainers have issued a fix, which is referenced in the linked advisory.

    0000043
    12 followersView on X

Explore more

Back to dashboard