CVE-2026-100838

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

CVE-2026-100838

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

CVE-2026-100838 Contrast before 1.19.1 CopyFile Policy Symlink Subversion

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

CVE-2026-100838

The Contrast confidential-computing runtime for Kubernetes (versions before 1.19.1 ) contains a flaw in the CopyFile verification of policies generated by the Contrast CLI. This vulnerability allows a malicious process on an untrusted host, capable of connecting to the Kata agent VSOCK , to issue...

Contras Affected by CopyFile Policy Subversion via Symlinks

Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...

PT-2026-99458

Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.19.1 Description Kata agent policies generated by the Contrast CLI contain a flaw in the CopyFile verification process. This allows arbitrary writes to the guest root filesystem. A malicious process on an untrusted...

CVE-2020-2023 Kata Containers - Containers have access to the guest root filesystem device

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10...