CVE-2026-53657: Lima Guest Agent Socket Privilege Escalation (v2.1.3 Fix)

Technical summary

CVE-2026-53657 involves improper access controls on the Lima guest agent socket in versions before 2.1.3. The vulnerability exists in the qemu driver configuration where the socket at /run/lima-guestagent.sock lacks sufficient permission restrictions. An unprivileged local user can connect to this socket and leverage its tunneling capabilities to reach privileged Unix sockets (CWE-668: Exposure of Resource to Wrong Sphere) and execute arbitrary commands as root. The root cause is inadequate file permission enforcement (CWE-276: Incorrect Default Permissions), allowing any VM user to access what should be a privileged interface.

Business impact

For organizations using Lima in development or CI/CD environments on macOS, this vulnerability creates a path for lateral privilege escalation within VMs. A developer or CI agent account without explicit root access could obtain full VM control, potentially compromising containerized applications, stealing sensitive data from containers, or pivoting to the host macOS system if container escape vectors are chained with this vulnerability. The impact is primarily confined to environments where multiple untrusted users share the same Lima instance or where a single compromised account could be leveraged for further attacks.

Affected systems

Lima versions prior to 2.1.3 are affected when configured with the qemu driver and the guest agent is enabled. This is most common on macOS systems running Lima for container development. The vulnerability requires local access to the Lima VM; remote users cannot directly exploit it. However, any local user account in the VM—including service accounts, CI runners, or other developers—can trigger the issue.

Exploitability

Exploitation requires local access to the VM and does not need interaction or special configuration beyond having the guest agent enabled (which is typical). The CVSS vector AV:L/AC:L/PR:H indicates the attack vector is local and complexity is low, but privileges are required (PR:H) on the underlying system; however, once inside the VM as an unprivileged user, no additional privileges are needed to access the socket and chain to root. The practical barrier is relatively low—a standard user or service account in the VM can exploit this. There is no public exploit code required; access to the socket itself enables the attack.

Remediation

Upgrade Lima to version 2.1.3 or later. This release fixes the socket permission issue to prevent unprivileged VM users from accessing the guest agent interface. Organizations should prioritize this patch for any macOS development environment or CI/CD system using Lima with qemu, particularly where multiple users or service accounts operate within the same VM.

Patch guidance

Update Lima to version 2.1.3 or newer. Patch distribution depends on how Lima was installed: if via Homebrew, run `brew upgrade lima`; if built from source, rebuild from the latest main branch after the fix. Verify the installed version with `limactl version`. Test the patched version in a non-production environment first to ensure container workloads function normally. No VM images need to be recreated; the patch applies to the Lima host tool.

Detection guidance

Monitor for unexpected access to /run/lima-guestagent.sock from unprivileged processes within Lima VMs. Enable audit logging on the host macOS system to track qemu process activity. Within VMs, monitor process execution for commands that attempt to connect to D-Bus or other privileged sockets via the guest agent. Organizations using Lima in CI/CD should audit service account permissions and check for unexpected privilege escalation events in container logs. Host-level file access monitoring can flag attempts to read or write to the guest agent socket from non-privileged contexts.

Why prioritize this

Although the CVSS score is 8.2 (HIGH), the real-world priority depends on your environment. If you use Lima only as a single-user development tool on personal laptops, priority can be moderate. If Lima runs in shared CI/CD environments, multi-user development systems, or alongside untrusted code execution, this should be treated as urgent because any local compromise can lead to VM-wide root access. The vulnerability is not yet in CISA's KEV catalog, suggesting exploitation in the wild may be limited, but the fix is straightforward and should be deployed soon.

Risk score, explained

CVSS 8.2 reflects the high impact (confidentiality, integrity, and availability all rated high) and wide scope (C:H/I:H/A:H/S:C), but accounts for the requirement that an attacker must already have local access to the VM and some elevated privilege context on the underlying macOS system (PR:H). The scope change (S:C) indicates that a compromise of the VM can affect the confidentiality, integrity, and availability of the host or other VMs on the same system. The score appropriately reflects a serious but not critical vulnerability that requires pre-existing local access.

Frequently asked questions