CVE-2026-89021: MikroTik RouterOS Path Traversal Vulnerability

CVE-2026-89021 Overview

CVE-2026-89021 is a path traversal vulnerability in MikroTik RouterOS versions before 7.24.2. The flaw resides in the container package's OCI/tar image extraction routine, which fails to sanitize tar member paths and symlink targets during container import via /container/add. Attackers who can supply a crafted container image can write files outside the container root on the persistent data partition. Exploitation requires no container start and yields root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation. The 7.23.x long-term branch remains unpatched; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical.

Critical Impact
Attackers with permission to import container images can write arbitrary files as root on the RouterOS data partition, enabling persistence and integrity compromise of the router.

Affected Products

MikroTik RouterOS versions before 7.24.2 (container package)
MikroTik RouterOS 7.23.3 (long-term branch, unpatched)
MikroTik RouterOS 7.23.4 (long-term branch, unpatched)

Discovery Timeline

2026-09-14 - CVE-2026-89021 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89021

Vulnerability Analysis

The vulnerability [CWE-22] resides in the OCI/tar image extraction logic inside the RouterOS container package. When a user calls /container/add to import a container image, the extractor iterates over tar members and writes them to the container root directory. The code does not validate that entry names or symlink targets remain within the intended extraction root.

An attacker crafts a tar archive that embeds symlinks pointing to arbitrary absolute paths on the router's persistent data partition. Subsequent tar entries that resolve through those symlinks land outside the container root. Because the extractor runs with root privileges and does not require the container to be started, the attacker achieves file write primitives before any runtime isolation takes effect.

The available primitives include file creation, directory creation, file deletion via overlayfs whiteout entries, and hardlink creation across the persistent partition. These primitives support tampering with router configuration, dropping persistence artifacts, and staging further compromise.

Root Cause

The root cause is unsanitized tar member path handling during OCI image extraction. The extractor trusts attacker-controlled path components and symlink targets rather than resolving each entry against the extraction root and rejecting traversal sequences.

Attack Vector

Exploitation requires network access to the RouterOS management interface and high privileges to invoke /container/add, plus user interaction to import the malicious image. The container never has to run. See the VulnCheck advisory for extraction details. A code-level proof of concept is not published here because no verified exploit is available in the referenced advisory data.

Detection Methods for CVE-2026-89021

Indicators of Compromise

Unexpected invocations of /container/add on RouterOS devices, particularly from accounts that do not normally manage containers.
Container image imports referencing external or unfamiliar registries, or .tar uploads to devices without an operational history of container usage.
New or modified files on the persistent data partition that reside outside declared container root directories.
Overlayfs whiteout entries corresponding to deletion of RouterOS configuration or binary files.

Detection Strategies

Audit RouterOS logs for /container/add activity and correlate with the source IP, authenticated user, and image origin.
Compare container binaries against known-good hashes for 7.24.2 and flag devices still running 7.23.x or earlier 7.x container packages.
Inspect container manifests and tar contents in a sandbox before allowing import, rejecting archives with symlinks pointing outside the archive root.

Monitoring Recommendations

Forward RouterOS syslog and API audit events to a central platform and alert on container package installation or configuration changes.
Track integrity of key filesystem locations on the RouterOS data partition and alert on unexpected additions or deletions.
Monitor administrative sessions for high-privilege actions from unusual geographies or outside change windows.

How to Mitigate CVE-2026-89021

Immediate Actions Required

Upgrade affected devices to RouterOS 7.24.2 or later where the container package extraction fix is applied.
On devices pinned to the 7.23.x long-term branch, disable or uninstall the container package until a fixed long-term release is available.
Restrict access to the RouterOS management plane to trusted administrative networks and enforce strong authentication for accounts with container privileges.
Review recent container imports and inspect the persistent data partition for files created outside expected container roots.

Patch Information

MikroTik released the fix in RouterOS 7.24.2 stable, as documented in the MikroTik forum release announcement. At the time of publication no fixed long-term release exists; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical and remain vulnerable.

Workarounds

Remove or do not install the container package on RouterOS devices that do not require container workloads.
Limit the container policy permission to a minimal set of administrators and prohibit imports from untrusted image sources.
Only import container images built from internally trusted registries with verified provenance and content hashes.

bash

# Configuration example: remove the container package and restrict admin access
/system package uninstall container
/ip service disable api,api-ssl,www,www-ssl,telnet,ftp
/user group set full policy="local,ssh,reboot,read,write,policy,test,password,sensitive,api"
/ip firewall filter add chain=input action=drop in-interface-list=!LAN