A high-severity vulnerability in the Lima virtual machine manager, identified as CVE-2026-53657, creates a risk of privilege escalation and unauthorized resource access due to incorrect default permissions.

This vulnerability involves CWE-276 (Incorrect Default Permissions) and CWE-668 (Exposure of Resource to Wrong Sphere). An attacker with high-level privileges could exploit these configuration flaws to gain unauthorized access to resources within the virtualized environment.

The exploitation of this vulnerability could lead to a complete compromise of the virtual machine environment, resulting in unauthorized data access, modification, or denial of service. Given the CVSS score of 8.2, this represents a significant risk to the integrity and confidentiality of workloads running on Lima, potentially impacting critical development or containerized infrastructure.

Immediate Action: Upgrade to Lima version 2.1.3 or later to apply the necessary permission corrections.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to virtual machine configuration files or unexpected changes in resource permissions.

Compensating Controls: Restrict access to the host machine running Lima to only authorized administrators to mitigate the risk of local privilege escalation.

Public Exploit Available: false

The severity of this issue necessitates an immediate update to the latest patched version of Lima. Administrators should prioritize patching all systems currently running versions prior to 2.1.3 to prevent potential exploitation of these configuration weaknesses.