#firecracker

November 5, 2026

Coinspect published a full Firecracker sandbox escape from guest userspace. Stage one (CVE-2026-122192) reads and modifies live VMM memory and yields controlled code execution in the host-side Firecracker process; stage two bypasses the seccomp policy via io_uring to reach otherwise-blocked host operations. The PoC needed root in the guest but no guest-kernel code, using a full snapshot and virtio-balloon to reach the memory-discard path. Fixed in Firecracker v1.16.2 / v1.17.0; AWS says Lambda and Fargate customers are unaffected and is not assigning a separate CVE for the seccomp issue, whose redesign is under review in PR #6287 (Coinspect, AWS bulletin). Firecracker also isolates agent code in Bedrock AgentCore, Vercel Sandbox and E2B. · Vulnerabilities & Public Exploits