Read the docs
TI-2026-29927 Aliases CVE-2026-41326GHSA-q49m-57vm-c8cc

Kata Containers: CopyFile Policy Subversion via Symlinks

Priority HIGH 69CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers; even those running inside CVMs. This vulnerability is fixed in v3.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Partial kata-containers (kata-containers): 3.29.0github.com/kata-containers/kata-containers (Go): 0.0.0-20260422180503-1b9e49eb2763Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kata-containerskata-containers3.4.0 to before 3.29.03.29.0Patch availableCNA
—github.com/kata-containers/kata-containers (Go)before 0.0.0-20260422180503-1b9e49eb27630.0.0-20260422180503-1b9e49eb2763Patch availableGHSA-q49m-57vm-c8cc
  • kata-containers Vendorkata-containers Affected 3.4.0 to before 3.29.0 Fixed in 3.29.0 Patch available CNA
  • github.com/kata-containers/kata-containers (Go) Vendor— Affected before 0.0.0-20260422180503-1b9e49eb2763 Fixed in 0.0.0-20260422180503-1b9e49eb2763 Patch available GHSA-q49m-57vm-c8cc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:katacontainers:confidential_containers:*:*:*:*:*:*:*:*0.9.0 to before 0.20.0Vulnerablekata-containers
cpe:2.3:a:katacontainers:kata_containers:*:*:*:*:*:*:*:*3.4.0 to before 3.29.0Vulnerablekata-containers
  • cpe:2.3:a:katacontainers:confidential_containers:*:*:*:*:*:*:*:* Versions 0.9.0 to before 0.20.0 Vulnerable ·kata-containers
  • cpe:2.3:a:katacontainers:kata_containers:*:*:*:*:*:*:*:* Versions 3.4.0 to before 3.29.0 Vulnerable ·kata-containers

Remediation

  • Fix · CNA kata-containers (kata-containers) Fixed in 3.29.0
  • Fix · GHSA-q49m-57vm-c8cc github.com/kata-containers/kata-containers (Go) Fixed in 0.0.0-20260422180503-1b9e49eb2763 Advisory →

Red Hat 1 advisory

  • RHSA-2026:25200 Released 2026-06-17 · Red Hat rating Critical
    OpenShift Container Platform 4.19.34 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202606100451-0, rhcos-ppc64le-4.19.9.6.202606100451-0, rhcos-s390x-4.19.9.6.202606100451-0 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:25200
Not affected: 2 products
  • Confidential Compute Attestation
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41326
  2. 2026-10-03 Alias added: GHSA-q49m-57vm-c8cc

References

Patch 1

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences