CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Vulnerability summary

CVE-2026-44210 is a critical (CVSS 9.9) vulnerability in kata-containers. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-07-2026
   PublishedVulnerability first disclosed.
2. 24-07-2026
   Last modifiedVulnerability information updated.

Description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

• CWE-88Improper Neutralization of Argument Delimiters in a CommandThe product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.