CVE-2026-89021 MikroTik CVE debrief

Who should care

Defenders responsible for MikroTik RouterOS systems, especially those using container features, should assess exposure and prioritize verification and potential updates or mitigations.

Why it matters

Defenders should care about CVE-2026-89021 because it represents a path traversal vulnerability in MikroTik RouterOS before 7.24.2, allowing attackers to manipulate files outside the container root. This could lead to unauthorized data access, disruption of containerized services, or other security issues. Defenders responsible for MikroTik RouterOS systems, especially those using container features, should assess exposure and prioritize verification and potential updates or mitigations.

• Potential for root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition
• Possible unauthorized data access or modification
• Potential disruption of containerized services
• Need for verification of system exposure and potential updates or mitigations

Technical summary

A path traversal vulnerability exists in MikroTik RouterOS before 7.24.2, specifically in the container package OCI/tar image extraction. This allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. The vulnerability could lead to unauthorized data access, disruption of containerized services, or other security issues. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container.

Defensive priority

Defenders should prioritize verifying exposure of MikroTik RouterOS systems, especially those using container features, and assess the need for updates or mitigations.

Recommended defensive actions

• Verify exposure of MikroTik RouterOS systems, especially those using container features
• Assess the need for updates or mitigations
• Inventory and check systems for potential vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on a path traversal vulnerability in MikroTik RouterOS before 7.24.2, allowing attackers to write files outside the container root by supplying a crafted container image.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.