kata-containers: Kata Containers: Privilege escalation and information disclosure via command-line argument injection (CVE-2026-44210)

Overview

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines (VMs) for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. This injection allows an attacker to override the shared directory, enabling the guest VM to access the entire host's root filesystem. When combined with another default configuration, this vulnerability allows an attacker to read and write any file on the host system, leading to significant information disclosure and potential privilege escalation.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-22 · vex

kata-containers: Kata Containers: Privilege escalation and information disclosure via command-line argument injection — rated Important by Red Hat. Released 2026-07-23, updated 2026-09-22.

Affected:

• Red Hat OpenShift Container Platform 4

No fix planned:

• Red Hat OpenShift Container Platform 4

Not affected:

• Red Hat OpenShift Container Platform 4

Remediation

Affected

Package advisory (CVE-2026-44210)

Affected packages:

• github.com/kata-containers/kata-containers < 0.0.0-20260519062212-ffa59ce3aa78

Patched in:

• github.com/kata-containers/kata-containers 0.0.0-20260519062212-ffa59ce3aa78

Source: https://osv.dev/vulnerability/GHSA-rr59-xxvx-96qr