Skip to content
Fencer Vulns
critical 9.2

CVE-2026-47243 json

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

published 2026-05-27 5 mo ago modified 2026-09-09 1 mo ago also GHSA-2gv2-cffp-j227 , GO-2026-5042 , EUVD-2026-54710

cvss
9.2
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process's mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0.

Patch / fix

  • go github.com/kata-containers/kata-containers 0.0.0-20260519062212-ffa59ce3aa78
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA 4.0 9.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go github.com/kata-containers/kata-containers
<0.0.0-20260519062212-ffa59ce3aa78
0.0.0-20260519062212-ffa59ce3aa78

Affected products

  • kata-containers kata-containers

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-36 Absolute Path Traversal

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.