Cloudanix VulnDB

CVE-2026-12080

High · 7.3

CVSS

7.3

EPSS

0.1%

Published

Jul 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A regular user inside a virtual machine could trick the system into handing over complete control by cleverly using file links to bypass security checks.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
Application
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Local unprivileged user exploits symlink bypass or TOCTOU race in the guest-ssh-add-authorized-keys handler of QEMU Guest Agent to change ownership of arbitrary root-owned files or directories, resulting in root privilege escalation.

Why it matters to the business

Enables local attackers to gain full root control over affected virtual machine guests, potentially compromising VM management, data integrity, and allowing further lateral movement within the virtualization environment.

How an attack unfolds

An attacker with local access creates malicious symbolic links targeting the guest-ssh-add-authorized-keys command path. When an external management layer such as libvirt invokes the handler, the attacker either uses a deterministic directory symlink or wins a file-symlink TOCTOU race to redirect operations, gaining ownership of root files and achieving root access.

How to fix it

Update the QEMU Guest Agent to a version containing fixes for symlink handling and TOCTOU races in the guest-ssh-add-authorized-keys handler. Restrict or disable the affected command through management-layer configuration until the update is applied.

How to confirm the fix worked

Verify the installed QEMU Guest Agent version against patched releases, review code or release notes for symlink and TOCTOU protections, and test the command handler under controlled conditions with symlinks to confirm unauthorized ownership changes are prevented.

Typical attack path

  1. Obtain local unprivileged access to the guest VM
  2. Prepare symbolic links to target the ssh-authorized-keys handler
  3. Trigger the affected command via an external management layer such as libvirt
  4. Exploit the symlink bypass or TOCTOU race condition
  5. Acquire ownership of root-owned files or directories
  6. Escalate to full root privileges

How to detect it

Examine QEMU Guest Agent logs, system audit logs, and libvirt command traces for invocations of guest-ssh-add-authorized-keys accompanied by unexpected symlink creation or sudden changes in file ownership on root-owned paths.

What your security team should do

  • Prioritize patching QEMU Guest Agent on all managed guests as soon as fixed versions are released
  • Limit local user permissions and isolate guest-agent command access via libvirt or equivalent management layers
  • Enable logging of file ownership changes and guest-agent command invocations for monitoring
  • Review virtualization host configurations to reduce exposure of the affected code path

The record

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities