Junglewise Threat Intelligence

CVE-2026-41326: Kata Containers arbitrary file write via CopyFile symlink subversion

CVE-2026-41326 · Severity: high · CVSS 8.2 · Published 2026-04-24

Technologies: Red Hat OpenShift Container Platform, github.com/kata-containers/kata-containers (Go). Vendors: Red Hat, Go.

Executive brief

Kata Containers, a tool used to run secure and lightweight virtual machines, contains a security flaw in how it handles file copying between the host system and the virtual machine. An attacker with access to the host system could bypass security policies to write malicious files or overwrite critical system binaries inside the protected virtual machine. This could lead to the theft of sensitive data or full control over the applications running within the secure environment, even when using hardware-based confidential computing.

Technical details

A vulnerability exists in the Kata Containers 'CopyFile' API due to insufficient validation of symbolic links within the 'genpolicy' implementation. While the security policy checks that the destination path is within a designated shared directory, it fails to account for the fact that the Kata Agent supports creating symlinks via the same API. An attacker on the host can create a symlink in the shared directory that points to a sensitive location (such as a system binary) within the guest image, and then use a subsequent CopyFile request to overwrite that target. This allows for arbitrary code execution in the guest and data exfiltration, bypassing the protections intended for Confidential Virtual Machines (CVMs). The issue is fixed in Kata Containers v3.29.0 and Confidential Containers v0.20.0.

Affected products

  • Kata Containers Kata Containers v3.4.0 - v3.28.0
  • Kata Containers Confidential Containers v0.9.0 - v0.19.0
  • Red Hat Red Hat OpenShift Container Platform 4.19, 4

Timeline

  • 2026-04-22: advisory: GitHub Security Advisory published
  • 2026-04-22: patched: Fix committed to repository
  • 2026-04-24: disclosed: CVE published to NVD

References

Related threats