Summary
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass WasiCtxBuilder per-preopen FilePerms and modify host files that were exposed as FilePerms::READ.
This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem.
This attack is also possible through an indirection of renaming a hardlink into another preopen.
Details
WasiCtxBuilder::preopened_dir documents file_perms as the maximum permissions usable for files in that preopen. However, hard-link creation and renaming only checked directory mutation for permission, and not whether the file permissions matched.
This makes an attack possible where:
- a read-only file
targetexists in a preopen with only FilePerms::READ - a hardlink named
alias, with destination to thetarget, is created in a preopen with FilePerms::READ | FilePerms::WRITE - the attacker opens the file
aliasfor writing, in which they can overwritetarget
The same attack is possible by way of renaming:
- a read-only file
targetexists in a preopen with only FilePerms::READ - a hardlink named
alias, with destination to thetarget, is created in that same preopen - the
aliasfile is renamed into a preopen with FilePerms::READ | FilePerms::WRITE - the attacker opens the file
aliasfor writing, in which they can overwritetarget
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors.
Impact
Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder:
builder.preopened_dir("readwrite", "readwrite", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE);
builder.preopened_dir("readonly", "readonly", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ);
In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens.
The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.
CVE-2026-58494 has a CVSS score of 6.5 (Medium). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (24.0.11, 36.0.12, 45.0.3, 46.0.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The definition of Dir::link_at and Dir::rename_at in wasmtime-wasi's src/filesystem.rs now have an additional permissions check that ensures the source and destination values for the directory permissions perms and the file permissions file_perms are identical.
if self.perms != new_dir.perms || self.file_perms != new_dir.file_perms {
return Err(ErrorCode::NotPermitted);
}
Frequently Asked Questions
- What is CVE-2026-58494? CVE-2026-58494 is a medium-severity incorrect authorization vulnerability in wasmtime-wasi (rust), affecting versions < 24.0.11. It is fixed in 24.0.11, 36.0.12, 45.0.3, 46.0.1. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
- How severe is CVE-2026-58494? CVE-2026-58494 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of wasmtime-wasi are affected by CVE-2026-58494? wasmtime-wasi (rust) versions < 24.0.11 is affected.
- Is there a fix for CVE-2026-58494? Yes. CVE-2026-58494 is fixed in 24.0.11, 36.0.12, 45.0.3, 46.0.1. Upgrade to this version or later.
- Is CVE-2026-58494 exploitable, and should I be worried? Whether CVE-2026-58494 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-58494 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-58494?
- Upgrade
wasmtime-wasito 24.0.11 or later - Upgrade
wasmtime-wasito 36.0.12 or later - Upgrade
wasmtime-wasito 45.0.3 or later - Upgrade
wasmtime-wasito 46.0.1 or later
- Upgrade