CVE-2026-24834

katacontainers kata containers

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-24834

Katalog CVE

CVSS 8.8 · High EPSS 0,23%

Kerentanan Incorrect Permission Assignment for Critical Resource pada katacontainers kata containers. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.

Rincian

Terbit di NVD
19 Februari 2026
Terakhir diubah
15 Juli 2026
Status NVD
Modified
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-281: Improper Preservation of Permissions
EPSS (30 hari)
0,23% peluang dieksploitasi; lebih tinggi dari 12,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
katacontainers kata containers Semua versi sebelum 3.27.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.