CVE-2026-77176

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-77176
https://bugzilla.redhat.com/show_bug.cgi?id=2517502
https://github.com/kata-containers/kata-containers/security/advisories/GHSA-fmg6-v47x-52wr
http://www.openwall.com/lists/oss-security/2026/08/20/19

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Kata Containers. En configuraciones que utilizan genpolicy para la protección de invitados de Contenedores Confidenciales, un operador de host malicioso puede explotar la validación insuficiente de las reglas de montaje y almacenamiento de CreateContainer. Esto les permite montar rutas arbitrarias de container-rootfs sobre ubicaciones sensibles del host o aprovisionar contenido arbitrario, exponiendo potencialmente información confidencial o permitiendo la aceptación de entrada controlada por el atacante.

Information

Published : 2026-08-20 17:19

Updated : 2026-10-31 09:16

NVD link : CVE-2026-77176

Mitre link : CVE-2026-77176

CVE.ORG link : CVE-2026-77176

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-77176", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77176", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T15:45:24.984463Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "kata-containers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:5"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 5", "packageName": "kata-containers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:5"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 5", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-08-20T17:19:49.773", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-77176", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517502", "source": "secalert@redhat.com"}, {"url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-fmg6-v47x-52wr", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/20/19", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Kata Containers. En configuraciones que utilizan genpolicy para la protecci\u00f3n de invitados de Contenedores Confidenciales, un operador de host malicioso puede explotar la validaci\u00f3n insuficiente de las reglas de montaje y almacenamiento de CreateContainer. Esto les permite montar rutas arbitrarias de container-rootfs sobre ubicaciones sensibles del host o aprovisionar contenido arbitrario, exponiendo potencialmente informaci\u00f3n confidencial o permitiendo la aceptaci\u00f3n de entrada controlada por el atacante."}], "lastModified": "2026-10-31T09:16:34.050", "sourceIdentifier": "secalert@redhat.com"}