PT-2026-35062 · Unknown · Kata Containers

Fidencio · CVE-2026-41326 · Published 2026-04-24 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions 3.4.0 through 3.28.0

Description An oversight in the CopyFile policy and potentially the CopyFile handler allows untrusted hosts to write to arbitrary locations within the guest workload image. This flaw can be exploited to overwrite binaries inside the guest and exfiltrate data from containers, including those running inside Cloud Virtual Machines (CVMs).

Recommendations Update to version 3.29.0.

Exploit

Fix

Weakness Enumeration

CWE-61

CWE-1220

Related Identifiers

CVE-2026-41326

GHSA-Q49M-57VM-C8CC

GO-2026-5563

OPENSUSE-SU-2026:21483-1

Affected Products

Kata Containers

References · 1752

• 🔥 https://github.com/kata-containers/kata-containers/security/advisories/GHSA-q49m-57vm-c8cc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41326.json · Exploit
• https://github.com/kata-containers/kata-containers/commit/1b9e49eb2763aa6ea6a99b276d3ff5e2c7f658f2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41326 · Security Note
• https://osv.dev/vulnerability/GHSA-q49m-57vm-c8cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41326 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25200 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5563 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/kata-containers/kata-containers · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note