CVE-2026-50540 Kata Containers: Config Path Annotation Arbitrary File Loading

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

CVE-2026-50540

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

PT-2026-69150

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 4.0.0 Description The kata-runtime allows host code execution due to an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config path pod annotation and loads the...

CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16

CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16. A patched version of the package is available...

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7. A patched version of the package is available...

SUSE CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines VMs for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. This injection allows an...

AZL-94232 CVE-2026-55969 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94160 CVE-2026-55969 affecting package kata-containers-preview 3.27.0~preview2-2

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

...

AZL-93066 CVE-2026-44210 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210

Summary: CVE-2026-44210 describes a VM escape in Kata Containers prior to 3.31.0 where default pod annotations enable virtiofsd extra args and kernel params, allowing an attacker with pod-creation privileges to inject arguments that override the virtiofsd shared directory to the host root. This c...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

CVE-2026-50540

A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitrary configuration file on the host. This allows the attacker to control privileged runtime settings, leading ...

AZL-93213 CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93087 CVE-2026-56852 affecting package kata-containers-preview 3.27.0~preview2-2

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93210 CVE-2026-56852 affecting package kata-containers for versions less than 3.32.0.kata0-1

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

EulerOS 2.0 SP12 : kata-containers (EulerOS-SA-2026-2594)

"According to the versions of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...