CVE-2026-77621: Vector Path Traversal Vulnerability

CVE-2026-77621 Overview

Vector is a high-performance observability data pipeline maintained by Datadog. A path traversal vulnerability [CWE-22] affects the file sink in versions from 0.10.0 through 0.56.x. The file sink renders its templated output path from event fields and opens the resulting file without confining it to an intended directory. When an untrusted source supplies an event field referenced by the path template, the value can contain an absolute path or parent-directory traversal sequences. Vector then creates parent directories and writes or overwrites files outside the intended location using the Vector process privileges. The issue is fixed in version 0.57.0.

Critical Impact
Attackers controlling event fields can overwrite scheduled tasks, authorization files, or executable scripts to achieve code execution with Vector process privileges.

Affected Products

Vector (vectordotdev/vector) versions 0.10.0 through 0.56.x
Deployments using the file sink with templated paths derived from event fields
Any Vector pipeline ingesting from untrusted or attacker-influenced sources

Discovery Timeline

2026-09-22 - CVE-2026-77621 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77621

Vulnerability Analysis

The vulnerability resides in Vector's file sink component, which supports templated file paths that interpolate values from incoming event fields. Vector renders the template into a final filesystem path and calls the underlying file-open routine directly. No confinement check verifies that the rendered path stays within an operator-approved base directory. Vector also creates missing parent directories along the rendered path, which extends the attacker's write reach beyond files that already exist.

When an event field originates from an untrusted producer (for example, a log line, HTTP request body, or Kafka message), an attacker can inject an absolute path such as /etc/cron.d/pwn or a traversal sequence such as ../../../../root/.ssh/authorized_keys. The Vector process then creates or overwrites arbitrary files with its own privileges, which are frequently root in containerized or systemd deployments.

Root Cause

The root cause is the absence of path confinement between template rendering and file open. The fix in pull request #25820 introduces a base_dir and confinement configuration on file-based sinks. Rendered keys are validated against the configured base prefix before any filesystem operation. A follow-up in #25830 hardens diagnostics through a new KeyOutsideBasePrefixError internal event.

Attack Vector

Exploitation requires that an attacker influence at least one event field consumed by the file sink's path template. The attack does not require authentication to Vector itself and is network-reachable when Vector ingests remote sources. Successful exploitation converts a data pipeline into a write-anywhere primitive, which typically escalates to code execution by targeting cron jobs, systemd units, SSH authorized_keys, or scripts invoked by other processes.

rust

// Security patch excerpt: benches/files.rs — introduces confinement fields
            timezone: Default::default(),
            internal_metrics: Default::default(),
            truncate: Default::default(),
+           base_dir: None,
+           confinement: Default::default(),
        },
    );
// Source: https://github.com/vectordotdev/vector/commit/6951064ed1d295fbff67a5ba7da5971fc6f58c46

rust

// Follow-up hardening: src/internal_events/common.rs — bounded error reporting
pub struct KeyOutsideBasePrefixError<'a> {
-   pub key: &'a str,
+   /// Bounded preview of the rejected key — never the full rendered value,
+   /// so attacker-controlled input can't amplify into logs and secrets in
+   /// templated header/query fields don't leak.
+   pub key_preview: &'a str,
+   /// Full byte length of the rejected rendered value.
+   pub key_len: usize,
    pub message: &'a str,
}
// Source: https://github.com/vectordotdev/vector/commit/8832452f57afb536ea0de53a093f9fd1b669ccec

Detection Methods for CVE-2026-77621

Indicators of Compromise

Files created or modified by the Vector process user outside its documented output directory, particularly under /etc/cron.d/, /etc/systemd/system/, /root/.ssh/, or /var/spool/cron/.
Vector logs containing rendered paths with .., absolute path prefixes, or unexpected directory components in file sink emissions.
Post-upgrade log entries with error_type=confinement_failed or the KeyOutsideBasePrefixError event, indicating blocked traversal attempts.

Detection Strategies

Audit Vector configuration for file sinks whose path template references event fields sourced from untrusted inputs such as HTTP, syslog, or Kafka.
Enable filesystem auditing (auditd, eBPF, or equivalent) on the Vector process to flag writes outside its intended output tree.
Correlate Vector process file writes against a baseline of expected output directories; alert on any deviation.

Monitoring Recommendations

Monitor the Vector component_errors_total counter for the confinement_failed error type after upgrading to 0.57.0.
Ship Vector's own stderr and internal metrics to a separate SIEM or data lake to preserve tamper-evident logs.
Track parent-process creation of new cron jobs, systemd units, and shell scripts across hosts running Vector.

How to Mitigate CVE-2026-77621

Immediate Actions Required

Upgrade Vector to version 0.57.0 or later on all hosts and container images.
Inventory every file sink and identify which path templates interpolate event-derived fields.
Run the Vector service under a dedicated, least-privileged user account rather than root wherever feasible.

Patch Information

The fix ships in Vector v0.57.0. It adds mandatory confinement enforcement for templated file sink paths, introduced in PR #25820 and refined in PR #25830. Full technical details are documented in GitHub Security Advisory GHSA-6342-xwvw-c637.

Workarounds

Remove event-field interpolation from file sink path templates and use static or operator-controlled path components only.
Insert a remap (VRL) transform that sanitizes candidate path fields by stripping /, \, and .. sequences before the sink.
Constrain the Vector process with AppArmor, SELinux, or a read-only root filesystem so writes are permitted only in the intended output directory.

bash

# Example VRL sanitization before a file sink
[transforms.sanitize_path]
type = "remap"
inputs = ["source_untrusted"]
source = '''
  .safe_key = replace!(string!(.key), r'[/\\]|\.\.', "_")
'''

[sinks.safe_files]
type = "file"
inputs = ["sanitize_path"]
path = "/var/log/vector/out/{{ safe_key }}.log"
encoding.codec = "json"