Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path
Priority LOW 39CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Why it matters now
EPSS 0.00475 41st percentileScored 2026-11-07
Fix Fixed Kata Containers (Kata Containers): 1.11.1, 1.10.5github.com/kata-containers/runtime (Go): 1.9.1, 1.10.6, 1.11.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kata-containers | Kata Containers | 1.11 to before 1.11.1; 1.10 to before 1.10.5; 1 – 1.9 | 1.11.1, 1.10.5 | Patch available | CNA |
| — | github.com/kata-containers/runtime (Go) | before 1.9.1 | 1.9.1 | Patch available | GHSA-877x-32pm-p28x |
| — | github.com/kata-containers/runtime (Go) | 1.10.0 to before 1.10.6 | 1.10.6 | Patch available | GHSA-877x-32pm-p28x |
| — | github.com/kata-containers/runtime (Go) | 1.11.0 to before 1.11.1 | 1.11.1 | Patch available | GHSA-877x-32pm-p28x |
- Kata Containers Vendorkata-containers Affected 1.11 to before 1.11.1; 1.10 to before 1.10.5; 1 – 1.9 Fixed in 1.11.1, 1.10.5 Patch available CNA
- github.com/kata-containers/runtime (Go) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-877x-32pm-p28x
- github.com/kata-containers/runtime (Go) Vendor— Affected 1.10.0 to before 1.10.6 Fixed in 1.10.6 Patch available GHSA-877x-32pm-p28x
- github.com/kata-containers/runtime (Go) Vendor— Affected 1.11.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-877x-32pm-p28x
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:* | up to 1.9; 1.10 to before 1.10.5; 1.11 to before 1.11.1 | Vulnerable | kata-containers |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
- cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:* Versions up to 1.9; 1.10 to before 1.10.5; 1.11 to before 1.11.1 Vulnerable ·kata-containers
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Kata Containers (Kata Containers) Fixed in 1.11.1, 1.10.5
- Fix · GHSA-877x-32pm-p28x github.com/kata-containers/runtime (Go) Fixed in 1.9.1 Advisory →
- Fix · GHSA-877x-32pm-p28x github.com/kata-containers/runtime (Go) Fixed in 1.10.6 Advisory →
- Fix · GHSA-877x-32pm-p28x github.com/kata-containers/runtime (Go) Fixed in 1.11.1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Kata Containers 1.10.5, 1.11.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-01938 Kata Containers - Containers have access to the guest root filesystem devicePriority LOW 30
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-2026
- 2026-10-03 Alias added: GHSA-877x-32pm-p28x
References
Advisory 11
- https://github.com/kata-containers/runtime/releases/tag/1.11.1
- https://github.com/kata-containers/runtime/releases/tag/1.10.5
- https://github.com/kata-containers/runtime/issues/2712
- https://github.com/kata-containers/runtime/pull/2713
- FEDORA-2020-7a0b6071a4
- FEDORA-2020-2f5879aeb6
- FEDORA-2020-c33083813d
- FEDORA-2020-1af9cd8c87
- FEDORA-2020-61fcf3ffc7
- FEDORA-2020-15a1bde727
- https://nvd.nist.gov/vuln/detail/CVE-2020-2026
Other 6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2P7FHA4AF6Y6PAVJBTTQPUEHXZQUOF3P
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6JPBKAQBF3OR72N55GWM2TDYQP2OHK6H
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6W5MKF7HSAIL2AX2BX6RV4WWVGUIKVLS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NJAMOVB7DSOGX7J26QH5HZKU7GSSX2VU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QNJHSSPCKUGJDVXXIXK2JUWCRJDQX7CE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XWACJQSMY5BVDMVTF3FBN7HZSOSFOG3Q
More kata-containers Runtime vulnerabilities
- TI-2020-01940 Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file CVSS 3.1HIGH 8.8
- TI-2020-01938 Kata Containers - Containers have access to the guest root filesystem device CVSS 3.1MEDIUM 6.3
- TI-2020-01939 Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-2026 · CVE Program
- CVE-2020-2026 · NVD
- FIRST EPSS
- GHSA-877x-32pm-p28x · GitHub Advisory Database · CC BY 4.0
- CVE-2020-2026 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences