Is CVE-2026-47243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47243 being exploited in the wild.

How severe is CVE-2026-47243?

High severity, with a CVSS score of 4, published 27 May 2026.

Which products and versions are affected?

github.com/kata-containers/kata-containers (Go) < 0.0.0-20260519062212-ffa59ce3aa78, SEMVER:introduced=0,fixed=0.0.0-20260519062212-ffa59ce3aa78.

Is there a fix for CVE-2026-47243?

Yes. github.com/kata-containers/kata-containers (Go): upgrade to 0.0.0-20260519062212-ffa59ce3aa78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47243 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-47243?

Check whether you run github.com/kata-containers/kata-containers (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47243: Kata Containers runtime-rs guest escape via virtiofs symlink

Q: Is there a fix for CVE-2026-47243?

Yes. github.com/kata-containers/kata-containers (Go): upgrade to 0.0.0-20260519062212-ffa59ce3aa78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47243 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-47243?

Check whether you run github.com/kata-containers/kata-containers (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47243 · Severity: high · CVSS 4 · Published 2026-05-27

Kata Containers is a secure container runtime that uses lightweight virtual machines to isolate workloads. A vulnerability in the 'runtime-rs' component allows a user with administrative access inside a container to break out of the virtual machine and execute commands on the host server with full system privileges. This bypasses the primary security isolation provided by Kata, potentially leading to a complete compromise of the host infrastructure.

Technologies: github.com/kata-containers/kata-containers (Go). Vendors: Go.

Quick answers

Is CVE-2026-47243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47243 being exploited in the wild.
How severe is CVE-2026-47243?: High severity, with a CVSS score of 4, published 27 May 2026.
Which products and versions are affected?: github.com/kata-containers/kata-containers (Go) < 0.0.0-20260519062212-ffa59ce3aa78, SEMVER:introduced=0,fixed=0.0.0-20260519062212-ffa59ce3aa78.
Is there a fix for CVE-2026-47243?: Yes. github.com/kata-containers/kata-containers (Go): upgrade to 0.0.0-20260519062212-ffa59ce3aa78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47243 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-47243?: Check whether you run github.com/kata-containers/kata-containers (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kata-containers/kata-containers (Go): upgrade to 0.0.0-20260519062212-ffa59ce3aa78 or later
```
go get github.com/kata-containers/kata-containers@v0.0.0-20260519062212-ffa59ce3aa78
```

Technical details

A vulnerability exists in the Kata Containers 'runtime-rs' implementation when using the standalone virtio-fs path. The runtime incorrectly configures the host 'virtiofsd' daemon with '--sandbox none' and '--seccomp none' while running as root. An attacker with root privileges in the guest VM can bypass the guest kernel's virtio-fs client by directly interacting with the virtio-fs PCI device to send raw FUSE requests. Specifically, a 'FUSE_SYMLINK' request can be used to create symlinks at absolute paths on the host filesystem. By creating a symlink in a sensitive directory like '/etc/cron.d' that points back to a guest-controlled payload, the attacker can achieve arbitrary code execution as host root. This issue is patched in version 3.31.0.

Affected products

Kata Containers Kata Containers < 3.31.0

Identifiers

CVE-2026-47243
GHSA-2gv2-cffp-j227
GO-2026-5042

Timeline

2026-05-11: other: Vulnerability verified via PoC
2026-05-21: patched: Fix committed to repository
2026-05-27: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.