High severity · published Apr 24, 2026
CVE-2026-41326
Kata Containers: CopyFile Policy Subversion via Symlinks
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers; even those running inside CVMs. This vulnerability is fixed in v3.29.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
kata-containers · kata-containers
>= 3.4.0, < 3.29.0 · source: vendor
CC
Confidential Containers · Katacontainers
0.9.0 before 0.20.0 · source: NVD
KC
Kata Containers · Katacontainers
3.4.0 before 3.29.0 · source: NVD
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Container Platform 4.19 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41326
Patch
https://github.com/kata-containers/kata-containers/commit/1b9e49eb2763aa6ea6a99b276d3ff5e2c7f658f2
Third Party Advisory
https://github.com/kata-containers/kata-containers/security/advisories/GHSA-q49m-57vm-c8cc
Mailing List
http://www.openwall.com/lists/oss-security/2026/05/13/2
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25200
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-41326
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2460859
More from kata-containers
9.9
CVE-2026-44210
Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations
9.6
CVE-2026-50540
Kata Containers: Config Path Annotation Arbitrary File Loading
9.2
CVE-2026-47243
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
5.7
CVE-2026-64676
Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory