{"id":"CVE-2026-95614","kind":"vulnerability","aliases":["CVE-2026-95614"],"related":[],"title":"Zenitel Connect: container writes can run commands as host root","description":"The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.","summary":"Zenitel Connect before 1.11.0 applies an rsyslog configuration file from a data volume shared with the hiatus container. An attacker who can write to that container's filesystem can plant a crafted rsyslog config and run arbitrary OS commands as root on the host.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hiatus","infrastructure","rsyslog","self-hosted","zenitel-connect"],"not_affected_if":["version-1.11.0-or-later"],"how_to_check":"- Check the installed Zenitel Connect version; it is affected below `1.11.0`.\n- Look for a shared data volume mounted into the `hiatus` application container.","fix":"- Zenitel Connect: move to `1.11.0` or later.","status":"open","published_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:11+00:00","updated_at":"2026-11-13T16:48:11+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:11Z","model":"claude-haiku-5-5","output":{"fix":"- Zenitel Connect: move to `1.11.0` or later.","reach":"local","title":"Zenitel Connect: container writes can run commands as host root","impact":"high","summary":"Zenitel Connect before 1.11.0 applies an rsyslog configuration file from a data volume shared with the hiatus container. An attacker who can write to that container's filesystem can plant a crafted rsyslog config and run arbitrary OS commands as root on the host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zenitel-connect","hiatus","self-hosted","rsyslog"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the host OS.","analyst_note":"Confirm the affected product list and whether the hiatus container is network-reachable; the source gives only the NVD description.","how_to_check":"- Check the installed Zenitel Connect version; it is affected below `1.11.0`.\n- Look for a shared data volume mounted into the `hiatus` application container.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.11.0-or-later"],"who_is_affected":"Systems running Zenitel Connect before 1.11.0 where the hiatus application container shares a data volume with the host configuration watcher. Exposure depends on who can write inside the hiatus container; hosts without that shared volume or without a writable hiatus container are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000732,"input_tokens":4569,"output_tokens":550,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95614':13A,16A '1.11.0':29B,78C 'access':103C 'allow':98C 'appli':30B,79C 'applic':95C 'arbitrari':62B,111C 'attack':45B,100C 'command':7A,64B,113C 'config':59B 'configur':33B,72C,82C,125C 'connect':2A,25B,27B,76C 'contain':3A,43B,51B,96C,107C 'craft':57B,123C 'cve':11A,14A 'data':37B,87C 'execut':110C 'file':34B,83C,126C 'filesystem':53B,108C 'hiatus':17B,42B,94C,106C 'host':9A,22B,69B,71C,118C 'infrastructur':18B 'local':99C 'oper':119C 'os':63B,112C 'plant':55B 'root':10A,66B,115C 'rsyslog':19B,32B,58B,81C,124C 'run':6A,61B 'self':21B 'self-host':20B 'share':39B,91C 'system':120C 'via':121C 'volum':38B,88C 'watcher':73C 'write':4A,48B,102C 'written':84C 'zenitel':1A,24B,26B,75C 'zenitel-connect':23B","nicknames":[],"mitigations":[],"who_affected":"Systems running Zenitel Connect before 1.11.0 where the hiatus application container shares a data volume with the host configuration watcher. Exposure depends on who can write inside the hiatus container; hosts without that shared volume or without a writable hiatus container are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","hiatus","infrastructure","rsyslog","selfhosted","zenitelconnect"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95614':13A,16A 'command':7A 'connect':2A 'contain':3A 'cve':11A,14A 'host':9A 'root':10A 'run':6A 'write':4A 'zenitel':1A","search_b":"'1.11.0':29B 'appli':30B 'arbitrari':62B 'attack':45B 'command':64B 'config':59B 'configur':33B 'connect':25B,27B 'contain':43B,51B 'craft':57B 'data':37B 'file':34B 'filesystem':53B 'hiatus':17B,42B 'host':22B,69B 'infrastructur':18B 'os':63B 'plant':55B 'root':66B 'rsyslog':19B,32B,58B 'run':61B 'self':21B 'self-host':20B 'share':39B 'volum':38B 'write':48B 'zenitel':24B,26B 'zenitel-connect':23B","search_c":"'1.11.0':78C 'access':103C 'allow':98C 'appli':79C 'applic':95C 'arbitrari':111C 'attack':100C 'command':113C 'configur':72C,82C,125C 'connect':76C 'contain':96C,107C 'craft':123C 'data':87C 'execut':110C 'file':83C,126C 'filesystem':108C 'hiatus':94C,106C 'host':71C,118C 'local':99C 'oper':119C 'os':112C 'root':115C 'rsyslog':81C,124C 'share':91C 'system':120C 'via':121C 'volum':88C 'watcher':73C 'write':102C 'written':84C 'zenitel':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95614","severity":null,"published_at":"2026-11-13T16:19:38+00:00","modified_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}