Description

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-20T17:19:49.773Z",
  "pubdate": "2026-08-20T17:19:49.773Z",
  "executiveSummary": "A vulnerability has been identified in Kata Containers involving configurations that utilize genpolicy for Confidential Containers guest protection. The flaw stems from insufficient validation of CreateContainer mount and storage rules, allowing a malicious entity with host operator privileges to compromise the security boundary between the host and the confidential guest.\nThe primary impact of this security flaw includes the potential exposure of sensitive confidential information and the capability to inject or accept attacker-controlled input within the guest environment. This undermines the confidentiality and integrity guarantees typically provided by Confidential Containers.\nThe affected product is Kata Containers, specifically configurations employing genpolicy. Exploitation requires a threat actor to possess malicious host operator privileges, enabling them to manipulate storage and mount rules during container creation. No specific version numbers or external network exposure vectors are mandated beyond the compromised host operating tier.\nRisk implications are severe for environments relying on hardware-backed or software-isolated confidential computing paradigms, as host-level compromise directly translates to guest-level data exposure and code injection vectors.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation logic applied to CreateContainer mount and storage rules within the genpolicy component of Kata Containers. Specifically, the policy engine fails to properly sanitize or restrict paths specified in container mount configurations processed during the container creation lifecycle.\nThe vulnerable component is the genpolicy mechanism responsible for generating security policies for Confidential Containers guest protection. This component executes within the context of container setup operations where policy enforcement is critical to maintaining isolation between the host system and the guest kernel/rootfs.\nExploitation occurs when a malicious host operator manipulates the storage and mount directives supplied to the container creation pipeline. Because input validation is inadequate, the system fails to restrict paths to designated safe boundaries. Consequently, an attacker can construct malicious mount rules that map arbitrary container-rootfs paths directly over sensitive host locations, or conversely, provision arbitrary content into protected execution contexts.\nThe step-by-step attack flow proceeds as follows: First, the malicious host operator intercepts or directly configures the container initialization parameters using genpolicy. Second, the operator defines crafted CreateContainer requests containing malicious mount or storage definitions that bypass validation checks. Third, upon container instantiation, the storage subsystem honors the illegitimate rules, mounting arbitrary paths. Finally, the attacker achieves unauthorized access to confidential information residing within those mounted paths or forces the guest to ingest attacker-controlled input, thereby subverting the intended security guarantees of the Confidential Containers architecture."
}