What is the CVSS score of CVE-2026-24054?

CVE-2026-24054 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of DNS are affected by CVE-2026-24054?

A critical vulnerability in Kata Containers (CVE-2026-24054) with a perfect CVSS score of 10.0 affects organizations using containerized environments, particularly those relying on malformed…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24054?

Yes, a public proof-of-concept exploit is available for CVE-2026-24054. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24054?

Within 24 hours: Identify all systems running Kata Containers versions prior to 3.26.0 and assess exposure in production environments. Within 7 days: Apply vendor patch to upgrade Kata Containers to version 3.26.0 or later across all affected systems, beginning with critical infrastructure and production workloads. Within 30 days: Conduct post-patch validation testing, update container image scanning policies to detect malformed layers, and implement enhanced monitoring for suspicious bind-mount activities.

DNS CVE-2026-24054

CRITICAL

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-01-29 security-advisories@github.com

DNS Kata Containers Red Hat

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Medium–Critical)

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Red Hat

7.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 24, 2026 - 18:20 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 18:20 nvd

Patch available

CVE Published

Jan 29, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.

AnalysisAI

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security guarantee of hardware-isolated containers. PoC and patch available.

Technical ContextAI

CWE-754 improper check for unusual/exceptional conditions. Kata Containers uses lightweight VMs for container isolation — the escape breaks the VM boundary.