Description

Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers (CoCo) deployments, the kata-agent enforces an OPA/Rego-based AgentPolicy that must authorize every ttRPC API call, forming the security boundary that prevents an untrusted host from directing the confidential guest. Two ttRPC methods introduced with the mem-agent feature are missing this authorization check, so an untrusted host can invoke them unconditionally regardless of the guest's policy configuration. When mem-agent is enabled (off by default), this lets the host tamper with in-guest memory management by forcing swap, aggressive eviction, or compaction, resulting in attacker-controlled availability and performance degradation of the confidential workload entirely outside the agent-policy boundary. The impact does not include memory disclosure or code execution, and severity is bounded by the precondition that mem-agent must be explicitly enabled. This issue is fixed in version 4.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-07T22:16:59.480Z",
  "pubdate": "2026-08-07T22:16:59.480Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the kata-agent component of Kata Containers in versions prior to 4.0.0, specifically impacting confidential-guest memory management within Confidential Containers (CoCo) deployments.\nThe vulnerability arises from missing Open Policy Agent (OPA)/Rego-based AgentPolicy authorization checks on two ttRPC methods introduced with the mem-agent feature.\nThis flaw allows an untrusted host to unconditionally invoke these ttRPC APIs, entirely bypassing the configured security boundary intended to govern interactions between the host and the confidential guest.\nWhen the mem-agent feature is explicitly enabled (it is disabled by default), an attacker operating from the host can tamper with in-guest memory management by forcing swap operations, aggressive eviction, or memory compaction.\nThe resulting impact includes attacker-controlled availability degradation and performance disruption of the confidential workload, though the vulnerability does not grant memory disclosure or arbitrary code execution capabilities.\nExploitation requires the mem-agent feature to be enabled and leverages the positioning of an untrusted host interacting with the guest via ttRPC protocols.",
  "technicalDetails": "The vulnerability resides in the kata-agent component of Kata Containers, which is responsible for managing container lifecycles and executing guest-side operations within lightweight Virtual Machines.\nIn Confidential Containers (CoCo) deployments, the kata-agent enforces an OPA/Rego-based AgentPolicy to validate and authorize every incoming ttRPC API call. This policy enforcement mechanism acts as the primary security boundary preventing an untrusted host from issuing unauthorized control commands to the confidential guest.\nThe root cause of the vulnerability is the omission of this OPA/Rego authorization check for two specific ttRPC methods that were introduced alongside the mem-agent feature. Because these methods lack policy validation, they can be invoked unconditionally by the host regardless of the enforced AgentPolicy configuration.\nThe attack flow proceeds as follows: an attacker with control over the host system identifies that the mem-agent feature is enabled within the confidential guest. The attacker then crafts and transmits direct ttRPC API requests targeting the unprotected memory management methods. Because the kata-agent fails to validate these calls against the OPA/Rego policy, the guest accepts and executes the requests.\nThe payload behavior and post-exploitation impact are constrained to memory management manipulation. The host can force operations such as swapping, aggressive page eviction, and memory compaction. This direct manipulation leads to localized denial-of-service conditions, availability degradation, and performance throttling of the confidential workload running inside the guest.\nThe vulnerability affects Kata Containers versions prior to 4.0.0. Exploitation is contingent upon the precondition that the mem-agent feature is explicitly enabled in the deployment configuration. The attack vector relies on the local ttRPC communication channel between the host and the guest agent, requiring host-level access but bypassing guest-level authorization policies."
}