Improper access control in Kata Containers - CVE-2026-41326

Detailed vulnerability description

The vulnerability allows a remote attacker to overwrite files inside the guest workload image and disclose sensitive information from containers.

The vulnerability exists due to improper access control in the CopyFile policy and CopyFile handler when processing crafted CopyFile requests involving symlinks. A remote attacker can create a symlink from the shared directory to an arbitrary path and then send a second crafted CopyFile request to overwrite files inside the guest workload image and disclose sensitive information from containers.

The issue affects deployments using the upstream genpolicy implementation and is relevant to Confidential Containers workloads whose trust model forbids host access to container images.

How to mitigate CVE-2026-41326

Sources

• https://github.com/kata-containers/kata-containers/security/advisories/GHSA-q49m-57vm-c8cc
• https://github.com/kata-containers/kata-containers/security/advisories