Read the docs
TI-2026-34827 Aliases CVE-2026-47243GHSA-2gv2-cffp-j227

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Priority HIGH 75CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process's mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed kata-containers (kata-containers): 3.31.0github.com/kata-containers/kata-containers (Go): 0.0.0-20260519062212-ffa59ce3aa78

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kata-containerskata-containersbefore 3.31.03.31.0Patch availableCNA
—github.com/kata-containers/kata-containers (Go)before 0.0.0-20260519062212-ffa59ce3aa780.0.0-20260519062212-ffa59ce3aa78Patch availableGHSA-2gv2-cffp-j227
  • kata-containers Vendorkata-containers Affected before 3.31.0 Fixed in 3.31.0 Patch available CNA
  • github.com/kata-containers/kata-containers (Go) Vendor— Affected before 0.0.0-20260519062212-ffa59ce3aa78 Fixed in 0.0.0-20260519062212-ffa59ce3aa78 Patch available GHSA-2gv2-cffp-j227

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:katacontainers:kata_containers:*:*:*:*:*:*:*:*——kata-containers
  • cpe:2.3:a:katacontainers:kata_containers:*:*:*:*:*:*:*:* Versions — — ·kata-containers

Remediation

  • Fix · CNA kata-containers (kata-containers) Fixed in 3.31.0
  • Fix · GHSA-2gv2-cffp-j227 github.com/kata-containers/kata-containers (Go) Fixed in 0.0.0-20260519062212-ffa59ce3aa78 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47243
  2. 2026-10-03 Alias added: GHSA-2gv2-cffp-j227

References

Other 4

  • TI-2026-19382 Improper check for unusual conditions in kata-containers CVSS 4.0HIGH 8.8
  • TI-2026-20033 Kata Container to Guest micro VM privilege escalation CVSS 3.1CRITICAL 9.4
  • TI-2026-29927 Kata Containers: CopyFile Policy Subversion via Symlinks CVSS 4.0HIGH 8.2
  • TI-2026-32189 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations CVSS 4.0MEDIUM 5.8
  • TI-2026-37266 Kata Containers: Config Path Annotation Arbitrary File Loading CVSS 3.1CRITICAL 9.6
  • TI-2020-16502 An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences