{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/kata-containers/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-50540"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kata Containers"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Kata Containers"],"content_html":"\u003cp\u003eThe vulnerability, identified as CVE-2026-64676, resides within the Kata Containers mem-agent component. It involves an insufficient access control check within the ttRPC service, which is used for inter-process communication between the guest and the host or agent-related services. An untrusted host process or attacker with sufficient permissions on the host side can bypass security boundaries to interact with sensitive ttRPC methods. In the context of confidential computing, this flaw undermines the isolation guarantees of the confidential guest, as it provides a mechanism for unauthorized actors to read or modify the guest's memory space. Defenders should prioritize updating the Kata Containers runtime environment to versions where the mem-agent access control logic has been hardened.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the tampering of confidential guest memory, effectively breaking the security boundary provided by confidential computing hardware and software stacks. This poses a significant risk to the integrity and confidentiality of workloads running in isolated environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Kata Containers runtime to the latest security-hardened version provided by the upstream project. Review host-side access policies to ensure that only authorized processes have the ability to communicate with guest-side mem-agent sockets.\u003c/p\u003e\n","date_modified":"2026-08-09T09:38:38Z","date_published":"2026-08-09T09:35:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-kata-mem-agent/","summary":"A vulnerability in the Kata Containers mem-agent component allows an untrusted host to invoke unauthorized ttRPC methods, resulting in potential memory tampering within confidential guest environments.","title":"Unauthorized mem-agent ttRPC methods in Kata Containers","url":"https://feed.craftedsignal.io/briefs/2026-08-kata-mem-agent/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-47243"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kata-containers/kata-containers (\u003c 0.0.0-20260519062212-ffa59ce3aa78)","runtime-rs"],"_cs_severities":["high"],"_cs_tags":["kata-containers","virtiofs","fuse","privilege-escalation","container-escape"],"_cs_type":"advisory","_cs_vendors":["kata-containers","Kata Containers"],"content_html":"\u003cp\u003eA guest-to-host root escape vulnerability exists in Kata Containers when using the runtime-rs standalone virtio-fs path. This configuration, which runs \u003ccode\u003evirtiofsd\u003c/code\u003e on the host as root without sandboxing or seccomp, allows a malicious actor with root privileges inside the Kata guest VM to send raw FUSE requests directly to the host \u003ccode\u003evirtiofsd\u003c/code\u003e. Specifically, the \u003ccode\u003eFUSE_SYMLINK\u003c/code\u003e request can be leveraged to create arbitrary symlinks outside the intended virtio-fs shared directory. By creating symlinks in sensitive host paths like \u003ccode\u003e/etc/cron.d\u003c/code\u003e, an attacker can inject and execute arbitrary code as host root. This attack bypasses the guest kernel's normal filesystem validation and directly interacts with the host's file system management. The vulnerability affects Kata Containers versions prior to commit \u003ccode\u003e2ffd1538a296cff93a357bfba0dfca747480a1f8\u003c/code\u003e, and is reproducible using QEMU and Cloud Hypervisor.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains root-equivalent access inside the Kata guest VM.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the virtio-fs PCI device within the guest using \u003ccode\u003e/sys/devices/pci*\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker takes control of a virtio-fs queue in userspace, bypassing the guest kernel's virtio-fs client.\u003c/li\u003e\n\u003cli\u003eAttacker sends a \u003ccode\u003eFUSE_INIT\u003c/code\u003e request to initialize the FUSE connection.\u003c/li\u003e\n\u003cli\u003eAttacker discovers the runtime-rs sandbox ID and constructs the path to a guest-controlled payload, such as \u003ccode\u003e/tmp/kata-go-escape-payload\u003c/code\u003e, using the \u003ccode\u003epassthrough\u003c/code\u003e mount.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a raw \u003ccode\u003eFUSE_SYMLINK\u003c/code\u003e request. The request specifies a new symlink name as an absolute path on the host, e.g., \u003ccode\u003e/etc/cron.d/kata-go-escape-cron-\u0026lt;pid\u0026gt;\u003c/code\u003e, and sets the symlink target to point to the guest-controlled payload through a \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/root/...\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eThe host \u003ccode\u003evirtiofsd\u003c/code\u003e receives the \u003ccode\u003eFUSE_SYMLINK\u003c/code\u003e request and, due to the lack of proper validation, creates the symlink on the host filesystem in the specified location.\u003c/li\u003e\n\u003cli\u003eHost cron reads the \u003ccode\u003e/etc/cron.d\u003c/code\u003e directory, follows the newly created symlink, and executes the guest-controlled payload as host root.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to complete compromise of the host system, as the attacker gains the ability to execute arbitrary commands as root. This allows the attacker to bypass the Kata Containers isolation and potentially access sensitive data, disrupt services, or further compromise the host infrastructure. The provided PoC demonstrated this vulnerability, confirming guest-root to host-root command execution by creating a proof file in the host's \u003ccode\u003e/run\u003c/code\u003e directory. This bypasses the container's isolation and impacts the entire host system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of Kata Containers that addresses CVE-2026-47243 to prevent exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events on the host for the execution of unexpected binaries from \u003ccode\u003e/etc/cron.d\u003c/code\u003e using the provided Sigma rule \u003ccode\u003eDetect Cron Job File Creation\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement host-based intrusion detection systems (HIDS) to monitor for suspicious file system activity, particularly the creation of symlinks in sensitive directories such as \u003ccode\u003e/etc/cron.d\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview and harden the configuration of \u003ccode\u003evirtiofsd\u003c/code\u003e to ensure proper validation of file paths and prevent the creation of symlinks outside the intended shared directory.\u003c/li\u003e\n\u003cli\u003eEnable and configure seccomp profiles to restrict the capabilities of the \u003ccode\u003evirtiofsd\u003c/code\u003e process, limiting its ability to perform actions that could lead to privilege escalation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-09T09:35:56Z","date_published":"2026-05-27T22:51:24Z","id":"https://feed.craftedsignal.io/briefs/2026-05-kata-virtiofs-escape/","summary":"A vulnerability in Kata Containers allows a guest root user to escalate privileges to host root by exploiting the virtiofs shared file system to create arbitrary symlinks on the host.","title":"Kata Containers Guest-to-Host Root Escape via Virtiofs FUSE_SYMLINK","url":"https://feed.craftedsignal.io/briefs/2026-05-kata-virtiofs-escape/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-41326"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kata-containers/kata-containers (\u003c 0.0.0-20260422180503-1b9e49eb2763)"],"_cs_severities":["high"],"_cs_tags":["kata-containers","container-escape","symlink"],"_cs_type":"advisory","_cs_vendors":["kata-containers"],"content_html":"\u003cp\u003eAn oversight in the CopyFile policy within Kata Containers allows a malicious host to manipulate guest workload images. The vulnerability stems from insufficient validation within the \u003ccode\u003eCopyFileRequest\u003c/code\u003e policy, specifically related to symlink creation. The policy primarily checks the destination path of copied files but fails to adequately validate the target of symlinks created via the same API. This flaw was discovered by @calonso-nv and impacts environments where the \u003ccode\u003egenpolicy\u003c/code\u003e implementation is used to prevent host access to container images, including Confidential Containers workloads which rely on strong isolation. If the guest image is not protected from the host (e.g., when using unprotected host pull), the system is not vulnerable. The affected package is \u003ccode\u003ego/github.com/kata-containers/kata-containers\u003c/code\u003e versions prior to \u003ccode\u003e0.0.0-20260422180503-1b9e49eb2763\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a target file within the guest container image, such as a binary or configuration file they wish to overwrite.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a \u003ccode\u003eCopyFileRequest\u003c/code\u003e to create a symbolic link within the \u003ccode\u003e/run/kata-containers/shared/containers\u003c/code\u003e directory.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epath\u003c/code\u003e parameter of the request specifies the location of the symlink within the shared directory.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edata\u003c/code\u003e parameter of the request specifies the target of the symbolic link, which points to the target file identified in step 1, inside the guest file system.\u003c/li\u003e\n\u003cli\u003eThe Kata Agent processes the \u003ccode\u003eCopyFileRequest\u003c/code\u003e, creating the symbolic link within the shared directory, pointing to the target file inside the container image.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a second \u003ccode\u003eCopyFileRequest\u003c/code\u003e to copy malicious data into the symlink created in step 5.\u003c/li\u003e\n\u003cli\u003eThe Kata Agent writes the malicious data to the symlink, which then overwrites the original target file within the container image.\u003c/li\u003e\n\u003cli\u003eThe attacker restarts the container or waits for the compromised binary to be executed, achieving arbitrary code execution within the guest.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to overwrite arbitrary files within container images managed by Kata Containers. This can lead to arbitrary code execution within the guest environment, data exfiltration, and privilege escalation. This is particularly critical in Confidential Containers environments where the trust model explicitly forbids host access to container images. Affected systems are those employing the upstream \u003ccode\u003egenpolicy\u003c/code\u003e implementation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch or upgrade to \u003ccode\u003ego/github.com/kata-containers/kata-containers\u003c/code\u003e version \u003ccode\u003e0.0.0-20260422180503-1b9e49eb2763\u003c/code\u003e or later to address CVE-2026-41326.\u003c/li\u003e\n\u003cli\u003eMonitor the creation of symbolic links within the \u003ccode\u003e/run/kata-containers/shared/containers\u003c/code\u003e directory, using the provided Sigma rule, as this is an unusual operation (file_event).\u003c/li\u003e\n\u003cli\u003eImplement strict access controls and monitoring for the Kata Agent to prevent unauthorized \u003ccode\u003eCopyFileRequest\u003c/code\u003e messages.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-kata-containers-copyfile-symlink/","summary":"An oversight in the CopyFile policy in Kata Containers allows untrusted hosts to write to arbitrary locations inside the guest workload image via symlinks, enabling binary overwrites and data exfiltration.","title":"Kata Containers CopyFile Policy Subversion via Symlinks","url":"https://feed.craftedsignal.io/briefs/2024-01-03-kata-containers-copyfile-symlink/"}],"language":"en","title":"CraftedSignal Threat Feed - Kata Containers","version":"https://jsonfeed.org/version/1.1"}