Description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config_path pod annotation and loads the referenced host TOML file without restriction. As a result, a pod user who can place a file at a host-visible path can supply a configuration that selects an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host. This issue is fixed in version 4.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-07T21:17:28.827Z",
  "pubdate": "2026-08-07T21:17:28.827Z",
  "executiveSummary": "Kata Containers prior to version 4.0.0 is susceptible to a host code execution vulnerability caused by an unvalidated configuration path annotation in kata-runtime. The vulnerability stems from the runtime accepting an arbitrary io.katacontainers.config_path pod annotation and subsequently loading the referenced host TOML configuration file without proper validation or restriction. This flaw allows a pod user capable of placing a file at a host-visible path to supply a malicious configuration. Consequently, an attacker can select an attacker-controlled hypervisor or virtio-fs daemon binary, leading to arbitrary code execution with root privileges on the host system. The risk implication is severe, granting full host compromise to a compromised or malicious pod context. Exploitation requires the ability to place a configuration file at a host-visible path and leverage the unvalidated annotation during pod creation. The issue is fully resolved in version 4.0.0.",
  "technicalDetails": "The vulnerability resides within the kata-runtime component of Kata Containers prior to version 4.0.0. The root cause is the lack of input validation and sanitization on the io.katacontainers.config_path pod annotation processed by the runtime. When a pod is deployed with this specific annotation, the runtime reads and parses the referenced TOML configuration file located on the host file system without enforcing path restrictions or verifying the integrity and ownership of the target file.\nThe attack flow proceeds as follows: First, a pod user with the ability to place a file at a host-visible path creates a malicious TOML configuration file containing directives pointing to an attacker-controlled hypervisor or virtio-fs daemon binary. Second, the user initiates a pod creation request incorporating the io.katacontainers.config_path annotation directed at the newly planted malicious TOML file. Third, kata-runtime parses the supplied TOML configuration during the initialization phase of the lightweight Virtual Machine. Fourth, the runtime instantiates the components defined in the manipulated configuration, executing the attacker-specified binary.\nBecause kata-runtime operates with elevated privileges to manage hypervisors and virtual machine resources on the host, the execution of an attacker-controlled hypervisor or daemon binary results in arbitrary code execution as root on the host system. The vulnerable component is the configuration parser and annotation handler within kata-runtime. Authentication and privilege requirements for exploitation dictate that the attacker must be a pod user capable of placing files at host-visible paths and issuing pod creation requests with specific annotations. There is no network exposure dependency, as the attack vector relies on local file system interaction and container orchestration interfaces."
}