What is the CVSS score of CVE-2026-24054?

CVE-2026-24054 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a public PoC exploit available for CVE-2026-24054?

Yes, a public proof-of-concept exploit is available for CVE-2026-24054. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24054?

Within 24 hours: Identify all systems running Kata Containers versions prior to 3.26.0 and assess exposure in production environments. Within 7 days: Apply vendor patch to upgrade Kata Containers to version 3.26.0 or later across all affected systems, beginning with critical infrastructure and production workloads. Within 30 days: Conduct post-patch validation testing, update container image scanning policies to detect malformed layers, and implement enhanced monitoring for suspicious bind-mount activities.

Kata Containers CVE-2026-24054

CRITICAL

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-01-29 security-advisories@github.com

DNS Red Hat Kata Containers Katacontainers

Critical

Disputed · 10.0 NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Push malformed container image
Delivery

containerd binds empty snapshotter directory
Exploit

Kata runtime detects bind mount as block device
Execution

Device hotplugged to guest
Impact

Filesystem corruption on host

Vulnerability Assessment

Weakness	CWE CWE-754 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Unusual condition handling
Exploitation Conditions	Container runtime using Kata with containerd backend. Requires ability to push or deploy malformed container images (no layers) to the registry or host. Affects Kata Containers versions prior to 3.26.0 in default configurations.
Impact	CVSS 10.0. Kata Containers is used when stronger isolation than standard containers is needed (multi-tenant, untrusted workloads). Escape undermines the entire security model.
Exploit ScenarioDerived	Malicious container escapes the Kata VM sandbox, gains access to the host system, other containers, and the Kubernetes control plane.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security guarantee of hardware-isolated containers. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:00 CVSS 10.0

VM sandbox escape in Kata Containers.

RemediationAI

Apply Kata Containers security update immediately.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-754 improper check for unusual/exceptional conditions. Kata Containers uses lightweight VMs for container isolation — the escape breaks the VM boundary.

Know when Kata Containers gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

GitHub Advisory PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Red Hat 7.3 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 24, 2026 - 18:20 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 18:20 nvd

Patch available

CVE Published

Jan 29, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.

Executive ViewAI

Why It Matters

A critical vulnerability in Kata Containers (CVE-2026-24054) with a perfect CVSS score of 10.0 affects organizations using containerized environments, particularly those relying on malformed container images or lightweight VM implementations. While the exploit probability remains low at 0.1% EPSS, the availability of public exploits and the potential for complete system compromise necessitate immediate patching to prevent unauthorized access and data breach risks.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 74% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.