Arbitrary Code Execution in Kata Containers Affected by Cloud Hypervisor

CVE-2026-24834

What is CVE-2026-24834?

Kata Containers, an open-source initiative for lightweight virtual machines that operate like containers, has a vulnerability related to the Cloud Hypervisor. In versions prior to 3.27.0, this flaw allows unauthorized users to modify the file system of the Guest micro VM, potentially leading to arbitrary code execution with root privileges in that VM. While this vulnerability does not seem to affect the security of the host machine or other running containers/VMs, it is important to note that certain configurations, particularly those involving arm64 QEMU without NVDIMM read-only support, could theoretically expose the host to risks. Updating to version 3.27.0 is essential to mitigate this issue.

References