CVE-2026-53657: lima-vm lima Incorrect Default Permissions
Vulnerability summary
CVE-2026-53657 is a high (CVSS 8.2) Incorrect Default Permissions vulnerability in lima-vm lima. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.2HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.2HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Github.com/lima-vm1 product
- limaAll versions (No fix recorded)
Github.com/lima-vm/lima1 product
- v2< 2.1.3
Lima-vm1 product
- lima< 2.1.3
3 vendors · 3 products
References
6 links
- github.com/lima-vm/limaPACKAGE