SB2026072603 - Multiple vulnerabilities in Kata Containers

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072603

SB2026072603 - Multiple vulnerabilities in Kata Containers

Published: July 26, 2026

Security Bulletin ID SB2026072603
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-50540)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the host.

The vulnerability exists due to improper input validation in the kata-runtime load_config function when processing the io.katacontainers.config_path pod annotation. A remote user can supply a crafted configuration file path to execute arbitrary code on the host.

Exploitation requires the ability to set pod annotations and access to a host filesystem path containing an attacker-controlled TOML configuration file.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from the host filesystem to the guest.

The vulnerability exists due to improper access control in update_config_by_annotation in src/libs/kata-types/src/annotations/mod.rs when processing untrusted pod annotations. A remote user can set the io.katacontainers.config.runtime.sandbox_bind_mounts annotation to disclose sensitive information from the host filesystem to the guest.

The exposed host paths are bind-mounted read-only into the guest-shared filesystem. This affects runtime-rs only; the Go runtime does not honor the sandbox_bind_mounts annotation.


3) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code on the host.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the Dragonball virtio-blk device emulation when processing guest-supplied virtio-blk descriptors. A local user can submit a crafted virtio-blk request with an address near the end of guest RAM and an oversized length to execute arbitrary code on the host.

Exploitation requires the ability to write raw descriptors into the virtio-blk virtqueue from the guest kernel context, and some Kata guest kernels expose this to guest userspace root.


4) Missing Authorization (CVE-ID: CVE-2026-64676)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with in-guest memory management and cause availability and performance degradation of the confidential workload.

The vulnerability exists due to missing authorization in mem-agent ttRPC methods when handling ttRPC API calls. A remote attacker can invoke the affected methods unconditionally to tamper with in-guest memory management and cause availability and performance degradation of the confidential workload.

Only deployments with the mem-agent feature enabled are vulnerable.


Remediation

Install update from vendor's website.

References