Kata Containers CVE-2026-41326

Attacker must have local access to the host system running Kata Containers runtime (AV:L). No special privileges are required on the host (PR:N), meaning any local user or process can potentially trigger the vulnerability. The vulnerable CopyFile functionality must be invoked during container lifecycle operations, which occurs naturally during standard container creation, image provisioning, or volume mounting operations. Exploitation does not require specific non-default Kata configuration settings. The vulnerability affects both standard Kata deployments and confidential VM (CVM) configurations equally. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation can be automated once local host access is achieved. The primary limiting factor is the local attack vector requirement - remote exploitation is not possible without first compromising the host through other means.

This represents a critical trust boundary violation in container security contexts. CVSS 8.2 (High) accurately reflects severity given the local attack vector combined with cross-scope integrity impact (SC:H). The AV:L designation means the attacker requires local access to the host system, but PR:N (no privileges required) and AC:L (low complexity) indicate exploitation is straightforward once that access exists. The scope change (SC:H) is the critical factor - compromising the host-to-guest isolation defeats Kata's core security value proposition. For confidential VM deployments where the guest explicitly distrusts the host infrastructure, this vulnerability is catastrophic as it enables the exact threat model Kata CVMs were designed to prevent. No public exploit identified at time of analysis, but the straightforward nature (AC:L) and availability of proof-of-concept code in the GitHub security advisory (common practice) suggest low exploitation barrier. Real-world risk depends heavily on deployment context: high for multi-tenant environments or CVM use cases where host compromise is within the threat model; lower for single-tenant trusted infrastructure. Patch adoption is critical - v3.29.0 provides the only complete mitigation.

An attacker with local access to a Kata Containers host (potentially via a compromised admin account, co-tenant escape, or insider threat) crafts malicious CopyFile requests targeting critical binaries inside running guest containers such as /bin/sh, application executables, or container init processes. The inadequate path validation permits writing outside intended directories, allowing complete replacement of trusted binaries with malicious versions. When the container executes these tampered binaries, the attacker achieves code execution inside the isolated guest. Additionally, the attacker can exfiltrate sensitive data by overwriting or creating files in locations accessible via container volume mounts or standard output channels. In confidential VM scenarios where the guest explicitly does not trust the host infrastructure provider, this enables the infrastructure operator to violate confidentiality and integrity guarantees.