PT-2026-35062 · Unknown · Kata Containers

Fidencio · Published 2026-04-24 · Updated 2026-05-15 · CVE-2026-41326

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kata Containers versions 3.4.0 through 3.28.0

Description An oversight in the CopyFile policy and potentially the CopyFile handler allows untrusted hosts to write to arbitrary locations within the guest workload image. This flaw can be exploited to overwrite binaries inside the guest and exfiltrate data from containers, including those running inside Cloud Virtual Machines (CVMs).

Recommendations Update to version 3.29.0.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-41326

GHSA-Q49M-57VM-C8CC

Affected Products

Kata Containers

References · 10

• 🔥 https://github.com/kata-containers/kata-containers/security/advisories/GHSA-q49m-57vm-c8cc · Exploit
• https://github.com/kata-containers/kata-containers/commit/1b9e49eb2763aa6ea6a99b276d3ff5e2c7f658f2 · Patch
• https://osv.dev/vulnerability/GHSA-q49m-57vm-c8cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41326 · Security Note
• https://github.com/kata-containers/kata-containers · Note
• https://twitter.com/CVEnew/status/2047798574336139638 · Twitter Post
• https://twitter.com/oss_security/status/2055172284638187754 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/13/2 · Note
• https://t.me/cveNotify/162050 · Telegram Post
• https://t.me/cveNotify/163473 · Telegram Post