CVE catalog
CVE-2026-41196
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to
- Severity
- Critical · CVSS 9
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
A flaw was found in Luanti (formerly Minetest), an open-source game platform. A malicious mod, when executed within the LuaJIT environment, can bypass security restrictions designed to isolate it. This allows the mod to execute unauthorized code and gain full access to the user's device, potentially leading to a complete system compromise. This vulnerability is only exploitable when using LuaJIT. You can use ```luanti --version``` to determine the type of Lua in use. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | minetest | Not reported | 5.15.2 | fixed |
| Ubuntu | minetest | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | fixed |
| Ubuntu | minetest-data | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | fixed |
| Ubuntu | minetest-server | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | fixed |
| Debian | luanti | 13 | 5.10.0+dfsg-5 | vulnerable |
| Debian | luanti | 13 | 5.10.0+dfsg-5+deb13u1 | fixed |
| Debian | luanti | 14 | 5.10.0+dfsg-5 | vulnerable |
| Debian | luanti | 14 | 5.14.0+dfsg-1 | vulnerable |
| Debian | luanti | 14 | 5.14.0+dfsg-2 | vulnerable |
| Debian | luanti | 14 | 5.14.0+dfsg-3 | vulnerable |
| Debian | luanti | 14 | 5.15.1+dfsg-1 | vulnerable |
| Debian | luanti | 14 | 5.15.1+dfsg-2 | vulnerable |
| Debian | luanti | 14 | 5.15.2+dfsg-1 | fixed |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-2build1 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-3 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4build2 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4build3 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | fixed |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-2build1 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-3 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4build2 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4build3 | vulnerable |
| Ubuntu | minetest | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | fixed |
| Ubuntu | luanti | 25.10 | 5.10.0+dfsg-5 | vulnerable |
| Ubuntu | luanti | 25.10 | 5.10.0+dfsg-5+deb13u1build0.25.10.1 | vulnerable |
| Ubuntu | luanti | 26.04 | 5.10.0+dfsg-5 | vulnerable |
| Ubuntu | luanti | 26.04 | 5.10.0+dfsg-5+deb13u1build0.26.04.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | minetest | cpe | Not reported | 5.15.2 | Not reported | Not reported | Not reported |
| Ubuntu | minetest | deb | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | minetest-data | deb | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | minetest-server | deb | noble | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Debian | luanti | deb | 13 | 5.10.0+dfsg-5+deb13u1 | Not reported | DEBIAN-CVE-2026-41196 | Not reported |
| Debian | luanti | deb | 14 | 5.15.2+dfsg-1 | Not reported | DEBIAN-CVE-2026-41196 | Not reported |
| Ubuntu | minetest | deb | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | Not reported | USN-8732-1 | Not reported |
| Ubuntu | minetest | deb | pro | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2026-41196 | Not reported |
| Ubuntu | luanti | deb | 26.04 | 5.10.0+dfsg-5+deb13u1build0.26.04.1 | Not reported | UBUNTU-CVE-2026-41196 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [luanti]Fixed
Details (4)
5.10.0+dfsg-5+deb13u1· amd64 · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· arm64 · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· amd64 · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· arm64 · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
- [luanti-data]Fixed
Source package: [luanti]
Details (4)
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
- [luanti-server]Fixed
Source package: [luanti]
Details (4)
5.10.0+dfsg-5+deb13u1· amd64 · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· arm64 · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· amd64 · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· arm64 · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
- [minetest]Fixed
Source package: [luanti]
Details (4)
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
- [minetest-data]Fixed
Source package: [luanti]
Details (4)
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
- [minetest-server]Fixed
Source package: [luanti]
Details (4)
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixieFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
5.10.0+dfsg-5+deb13u1· all · trixie-securityFixed · Fixed:
5.10.0+dfsg-5+deb13u1nvd · luanti · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-41196]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-41196]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-41196]
- [https://osv.dev/vulnerability/USN-8732-1]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41196.json]
- [https://ubuntu.com/security/notices/USN-8732-1]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]