Executive brief
Kata Containers is a secure container runtime that uses lightweight virtual machines to isolate workloads. A vulnerability in the 'runtime-rs' component allows a user with administrative access inside a container to break out of the virtual machine and execute commands on the host server with full system privileges. This bypasses the primary security isolation provided by Kata, potentially leading to a complete compromise of the host infrastructure.
Technical details
A vulnerability exists in the Kata Containers 'runtime-rs' implementation when using the standalone virtio-fs path. The runtime incorrectly configures the host 'virtiofsd' daemon with '--sandbox none' and '--seccomp none' while running as root. An attacker with root privileges in the guest VM can bypass the guest kernel's virtio-fs client by directly interacting with the virtio-fs PCI device to send raw FUSE requests. Specifically, a 'FUSE_SYMLINK' request can be used to create symlinks at absolute paths on the host filesystem. By creating a symlink in a sensitive directory like '/etc/cron.d' that points back to a guest-controlled payload, the attacker can achieve arbitrary code execution as host root. This issue is patched in version 3.31.0.
Affected products
- Kata Containers Kata Containers < 3.31.0
Timeline
- 2026-05-11: other: Vulnerability verified via PoC
- 2026-05-21: patched: Fix committed to repository
- 2026-05-27: advisory: GitHub Advisory published