EUVD-2026-63432Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Host operator access is PR:H; scope changes to C because the attack breaks Confidential Containers guest isolation boundary.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.
AnalysisAI
Confidential Containers isolation in Kata Containers can be subverted by a malicious host operator via insufficient path validation in genpolicy's CreateContainer mount and storage rule enforcement. Affected deployments include Red Hat OpenShift Container Platform 4 running Kata Containers with genpolicy enabled for Confidential Containers guest protection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Kata Containers deployment must be configured in Confidential Containers mode with genpolicy active - standard Kata deployments without genpolicy are outside the stated scope; (2) the attacker must hold or have compromised host operator-level credentials with the ability to issue CreateContainer API calls to the container runtime - this is not a low-privilege role and represents significant pre-existing access; (3) a target guest container must be scheduled or restarted so the malicious mount/storage rules are applied at container creation time. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score uses PR:L, which understates the privilege actually required - host operator access in a Kubernetes/OpenShift environment represents substantial pre-existing trust and infrastructure control, making this closer to a PR:H scenario in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised host operator with access to the OpenShift/Kubernetes orchestration plane crafts a CreateContainer request containing a manipulated mount rule that maps an attacker-controlled path over a sensitive location within the confidential guest container's filesystem. When the guest container initializes, it reads attacker-supplied content or exposes confidential data back through the improperly validated mount, breaking the confidentiality and integrity boundary that Confidential Containers are designed to enforce. … |
| Remediation | The primary remediation is to apply the patch or updated package addressing CVE-2026-77176 via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-77176 and the upstream fix documented in GHSA-fmg6-v47x-52wr at https://github.com/kata-containers/kata-containers/security/advisories/GHSA-fmg6-v47x-52wr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat OpenShift Container Platform 4 clusters running Kata Containers with genpolicy enabled and immediately implement strict RBAC restrictions limiting host operator privileges to minimum required access; enforce multi-factor authentication for all operator-level accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Privilege escalation in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a com
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privi
Credential theft in Red Hat OpenShift Container Platform's Windows Machine Config Operator (WMCO) allows adjacent-networ
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today