CVE-2026-64676 Details

An authorization bypass vulnerability has been identified in the kata-agent of Kata Containers, affecting versions through 3.31.0. This vulnerability arises in Confidential Containers (CoCo) deployments, where the kata-agent is supposed to enforce an OPA/Rego-based AgentPolicy that authorizes every ttRPC API call. However, two ttRPC methods introduced with the mem-agent feature lack this authorization check, allowing an untrusted host to invoke them unconditionally, regardless of the guest's policy configuration. When mem-agent is enabled, this exploitation can lead to unauthorized tampering with in-guest memory management, causing performance degradation and availability issues for confidential workloads, all outside the intended policy boundaries. Notably, this vulnerability does not involve memory disclosure or code execution.

Users can upgrade to Kata Containers version 4.0.0 or later, where this vulnerability has been fixed. For those involved in development, it is recommended to add the missing authorization check to the affected ttRPC handlers and include corresponding default-deny entries for these methods in the genpolicy rules and reference policies. Additionally, implementing a CI check to verify that every RPC in the agent protocol has a policy gate in the handler and a default rule in the policy file could prevent similar oversights in the future.