CVE-2026-47261
Description
A flaw was found in Wasmtime, a runtime for WebAssembly. This vulnerability allows an attacker to bypass intended access controls when a filesystem preopen is configured with read-only file permissions but also allows directory mutations. By using specific open flags, an attacker can truncate files that should not be writable, leading to unauthorized data modification. This issue affects wasmtime-wasi embeddings that combine directory mutation permissions with read-only file permissions.
Statement
Conditions for Exploitation: Successful exploitation relies on a highly specific configuration of wasmtime-wasi embeddings. The vulnerability only triggers if a filesystem preopen explicitly combines directory mutation permissions (DirPerms::MUTATE) with read-only file permissions (FilePerms::READ).
Impact Limitations: The flaw bypasses access controls solely to allow file truncation, resulting in unauthorized data modification or data loss. It does not enable an attacker to inject arbitrary data, read unpermitted files, execute arbitrary code, or escalate privileges on the host system.
Specific Components Not Affected: The standard Wasmtime command-line interface (wasmtime-cli) is completely unaffected by this bug, as it defaults to granting full file permissions for all preopens. This significantly reduces the likelihood of widespread exploitation in default deployments.
Mitigation
To mitigate this issue, ensure that `wasmtime-wasi` embeddings are not configured with a combination of `DirPerms::MUTATE` and `FilePerms::READ` for filesystem preopens. Review `WasiCtxBuilder` configurations to avoid this vulnerable permission combination, which allows an attacker to bypass access controls and truncate files that should otherwise be read-only.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
