Contrast CLI CopyFile Policy Subversion via Symlinks Allows Guest Root Filesystem Writes

hello@craftedsignal.io — Thu, 30 Apr 2026 20:57:17 +0000

A vulnerability exists in the Kata agent policies generated by the Contrast CLI (versions prior to v1.19.1). Specifically, the CopyFile verification process is flawed, enabling a malicious host process to write arbitrary data to the guest root filesystem. This attack vector leverages the Kata agent’s VSOCK interface, allowing a compromised host to connect to the agent and issue malicious CopyFile requests. The successful exploitation can overwrite critical security files or deceive the workload into divulging sensitive data. This flaw has a high impact, potentially resulting in a complete guest takeover. The issue was patched in Contrast v1.19.1.

Attack Chain

A malicious process gains the capability to connect to the Kata agent VSOCK.
The malicious process connects to the Kata agent via VSOCK.
The attacker crafts a series of CopyFile requests.
These CopyFile requests are designed to exploit the vulnerability in the Contrast CLI-generated Kata agent policies.
The attacker uses the CopyFile requests to create symlinks pointing to sensitive or critical system files.
The attacker then uses CopyFile requests to write arbitrary data to the targeted files via the created symlinks.
Security-critical files within the guest root filesystem are overwritten or modified by the attacker.
The compromised system facilitates a full guest takeover, potentially enabling further malicious activities within the containerized environment.

Impact

Successful exploitation allows a malicious host process to gain full control over the guest container. This can lead to data exfiltration, denial of service, or further lateral movement within the infrastructure. While the exact number of affected systems is not specified, any environment relying on affected Contrast CLI versions to generate Kata agent policies is potentially at risk. The impact is a full guest takeover.

Recommendation

Upgrade Contrast CLI to version v1.19.1 or later to remediate the vulnerability.
If upgrading is not immediately possible, implement the policy-only fix described in the provided resources, specifically the rego fix, and pass it to contrast generate --policy.
Monitor network connections to the Kata agent VSOCK for unusual or unauthorized activity, especially originating from untrusted processes.
Implement host-based intrusion detection systems (HIDS) to detect unauthorized file modifications within the guest root filesystem.

Kata Containers CopyFile Policy Subversion via Symlinks

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

An oversight in the CopyFile policy within Kata Containers allows a malicious host to manipulate guest workload images. The vulnerability stems from insufficient validation within the CopyFileRequest policy, specifically related to symlink creation. The policy primarily checks the destination path of copied files but fails to adequately validate the target of symlinks created via the same API. This flaw was discovered by @calonso-nv and impacts environments where the genpolicy implementation is used to prevent host access to container images, including Confidential Containers workloads which rely on strong isolation. If the guest image is not protected from the host (e.g., when using unprotected host pull), the system is not vulnerable. The affected package is go/github.com/kata-containers/kata-containers versions prior to 0.0.0-20260422180503-1b9e49eb2763.

Attack Chain

The attacker identifies a target file within the guest container image, such as a binary or configuration file they wish to overwrite.
The attacker crafts a CopyFileRequest to create a symbolic link within the /run/kata-containers/shared/containers directory.
The path parameter of the request specifies the location of the symlink within the shared directory.
The data parameter of the request specifies the target of the symbolic link, which points to the target file identified in step 1, inside the guest file system.
The Kata Agent processes the CopyFileRequest, creating the symbolic link within the shared directory, pointing to the target file inside the container image.
The attacker crafts a second CopyFileRequest to copy malicious data into the symlink created in step 5.
The Kata Agent writes the malicious data to the symlink, which then overwrites the original target file within the container image.
The attacker restarts the container or waits for the compromised binary to be executed, achieving arbitrary code execution within the guest.

Impact

Successful exploitation allows attackers to overwrite arbitrary files within container images managed by Kata Containers. This can lead to arbitrary code execution within the guest environment, data exfiltration, and privilege escalation. This is particularly critical in Confidential Containers environments where the trust model explicitly forbids host access to container images. Affected systems are those employing the upstream genpolicy implementation.

Recommendation

Apply the patch or upgrade to go/github.com/kata-containers/kata-containers version 0.0.0-20260422180503-1b9e49eb2763 or later to address CVE-2026-41326.
Monitor the creation of symbolic links within the /run/kata-containers/shared/containers directory, using the provided Sigma rule, as this is an unusual operation (file_event).
Implement strict access controls and monitoring for the Kata Agent to prevent unauthorized CopyFileRequest messages.

Kata-Containers — CraftedSignal Threat Feed

Contrast CLI CopyFile Policy Subversion via Symlinks Allows Guest Root Filesystem Writes

Attack Chain

Impact

Recommendation

Kata Containers CopyFile Policy Subversion via Symlinks

Attack Chain

Impact

Recommendation