Vulnerability in Kata Containers' Default Configuration Allows Code Injection

CVE-2026-44210

What is CVE-2026-44210?

Kata Containers is an open-source project dedicated to creating lightweight virtual machines that behave like containers. In versions before 3.31.0, a security flaw exists due to a default configuration that permits pod creators to inject arbitrary command-line arguments into the virtiofsd process via the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. This vulnerability allows an attacker to specify parameters that can expose the host’s entire root filesystem to the guest VM. By exploiting additional configurations, such as the enabled kernel_params annotation, the attacker gains access to the host filesystem, including sensitive files like /etc/shadow. The issue has been addressed in version 3.31.0.

References