CVE-2026-24834criticalCWE-281CWE-732

CVE-2026-24834: critical vulnerability in kata-containers

Kata Container to Guest micro VM privilege escalation

Published · Updated

Follow this CVE+ Monitor kata-containers+ Monitor github.com/kata-containers/kata-containers/src/runtime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.2%
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
kata-containers · kata-containers
Related CVEs — kata-containers

In the same product, most dangerous first.

CVE-2026-50540CRITICALKata Containers: Config Path Annotation Arbitrary File LoadingEPSS 0.6%CVE-2026-44210MEDIUMKata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod AnnotationsEPSS 0.6%CVE-2026-24054HIGHKata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layersEPSS 0.5%CVE-2026-41326HIGHKata Containers: CopyFile Policy Subversion via SymlinksEPSS 0.3%CVE-2025-58354MEDIUMKata Containers coco-tdx malicious host can circumvent initdata verificationEPSS 0.3%CVE-2026-47243CRITICALKata guest escape: runtime-rs guest-root to host-root escape via virtiofsEPSS 0.2%