CVE-2026-50540 Details
Description
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config_path pod annotation and loads the referenced host TOML file without restriction. As a result, a pod user who can place a file at a host-visible path can supply a configuration that selects an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host. This issue is fixed in version 4.0.0.
A vulnerability in Kata Containers runtime versions through 3.32.0 allows for host code execution. The issue arises from an unvalidated pod annotation, 'io.katacontainers.config_path', which the runtime uses to load a TOML configuration file from the host without any restrictions. This flaw enables a pod user to specify a configuration that directs to an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host. The vulnerability is present in the Rust runtime component, particularly in deployments on multi-tenant Kubernetes clusters.
Users can upgrade to Kata Containers version 4.0.0 or later, where this vulnerability has been addressed. Alternatively, an admission webhook can be used to reject pods that include the 'io.katacontainers.config_path' annotation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kata Containers kata-runtime | <= 3.32.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 24, 2026 | CVE Modified | CVE |
| Aug 23, 2026 | CVE Modified | CVE |
| Aug 12, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |