Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-41326Kata Containers: CopyFile Policy Subversion via Symlinks

High 8.8

In plain English

A high-severity security flaw in kata-containers from kata-containers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers; even those running inside CVMs. This vulnerability is fixed in v3.29.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kata-containers/kata-containers0.0.0-20260422180503-1b9e49eb2763GHSA-q49m-57vm-c8cc
Gogithub.com/kata-containers/kata-containers0.0.0-20260422180503-1b9e49eb2763GO-2026-5563

Affected products (as reported)

VendorProductVersions
kata-containers kata-containers >= 3.4.0, < 3.29.0

Weakness: CWE-61, CWE-1220 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References