What is the CVSS score of CVE-2026-24054?

CVE-2026-24054 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of DNS are affected by CVE-2026-24054?

A critical vulnerability in Kata Containers (CVE-2026-24054) with a perfect CVSS score of 10.0 affects organizations using containerized environments, particularly those relying on malformed…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24054?

Yes, a public proof-of-concept exploit is available for CVE-2026-24054. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24054?

Within 24 hours: Identify all systems running Kata Containers versions prior to 3.26.0 and assess exposure in production environments. Within 7 days: Apply vendor patch to upgrade Kata Containers to version 3.26.0 or later across all affected systems, beginning with critical infrastructure and production workloads. Within 30 days: Conduct post-patch validation testing, update container image scanning policies to detect malformed layers, and implement enhanced monitoring for suspicious bind-mount activities.

DNS CVE-2026-24054

CRITICAL

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-01-29 security-advisories@github.com

DNS Kata Containers Red Hat

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Medium–Critical)

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Red Hat

7.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 24, 2026 - 18:20 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 18:20 nvd

Patch available

CVE Published

Jan 29, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.

AnalysisAI

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security guarantee of hardware-isolated containers. PoC and patch available.

Technical ContextAI

CWE-754 improper check for unusual/exceptional conditions. Kata Containers uses lightweight VMs for container isolation — the escape breaks the VM boundary.