CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

Summary

Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

Details

The default Kata configuration at configuration.toml line 1 contains:

enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params", "kernel_verity_params"]

Both virtio_fs_extra_args and kernel_params are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.

In utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:

if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {
    var parsedValue []string
    err := json.Unmarshal([]byte(value), &parsedValue)
    // ...
    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(
        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)
}

In virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with --shared-dir=<kata_managed_path> first, then appends the extra args:

args := []string{
    "--syslog",
    "--cache=" + v.cache,
    "--shared-dir=" + v.sourcePath,
    fmt.Sprintf("--fd=%v", FdSocketNumber),
}
if len(v.extraArgs) != 0 {
    args = append(args, v.extraArgs...)
}

The virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option -o source=PATH that overrides the --shared-dir value. This is processed after clap argument parsing, in the parse_compat() function at main.rs:462:

["source", value] => opt.shared_dir = Some(value.to_string()),

Because -o source=/ is appended after --shared-dir=<kata_path>, it overrides the shared directory to /. The virtiofsd process then serves the entire host root filesystem through the virtio-fs device.

Additionally, virtiofsd's --announce-submounts flag (set by default) causes the guest kernel to create FUSE automounts for bind mounts within the shared directory. When the shared directory is /, this produces automounts that shadow the root directory listing. Injecting --no-announce-submounts disables this behavior and exposes the true host root directory contents through the kataShared virtiofs mount.

The kernel_params annotation is used to inject agent.debug_console agent.debug_console_vport=1026 into the VM kernel command line. This enables a root shell inside the VM through the kata-runtime exec command. From this shell, the attacker mounts the kataShared virtiofs filesystem and accesses host files directly.

Rootfs bridge (PoC artifact, not a real constraint)

When virtiofsd uses -o source=/ to serve the host root, the Kata agent looks for the container rootfs at /<container-id>/rootfs relative to the virtiofs root. The PoC pre-creates this directory on the host to keep the demonstration self-contained with ctr.

In a real Kubernetes attack, there are several ways to satisfy this without hostPath volumes. An initContainer that runs before the target container can create the directory. Alternatively, the attacker can set up a second pod that writes to a shared persistent volume mounted on the host. The rootfs bridge is a PoC convenience, not a limitation of the vulnerability itself.

Impact

An attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration…

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

Summary

Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

Details

The default Kata configuration at configuration.toml line 1 contains:

enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params", "kernel_verity_params"]

Both virtio_fs_extra_args and kernel_params are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.

In utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:

if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {
    var parsedValue []string
    err := json.Unmarshal([]byte(value), &parsedValue)
    // ...
    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(
        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)
}

In virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with --shared-dir=<kata_managed_path> first, then appends the extra args:

args := []string{
    "--syslog",
    "--cache=" + v.cache,
    "--shared-dir=" + v.sourcePath,
    fmt.Sprintf("--fd=%v", FdSocketNumber),
}
if len(v.extraArgs) != 0 {
    args = append(args, v.extraArgs...)
}

The virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option -o source=PATH that overrides the --shared-dir value. This is processed after clap argument parsing, in the parse_compat() function at main.rs:462:

["source", value] => opt.shared_dir = Some(value.to_string()),

Because -o source=/ is appended after --shared-dir=<kata_path>, it overrides the shared directory to /. The virtiofsd process then serves the entire host root filesystem through the virtio-fs device.

Additionally, virtiofsd's --announce-submounts flag (set by default) causes the guest kernel to create FUSE automounts for bind mounts within the shared directory. When the shared directory is /, this produces automounts that shadow the root directory listing. Injecting --no-announce-submounts disables this behavior and exposes the true host root directory contents through the kataShared virtiofs mount.

The kernel_params annotation is used to inject agent.debug_console agent.debug_console_vport=1026 into the VM kernel command line. This enables a root shell inside the VM through the kata-runtime exec command. From this shell, the attacker mounts the kataShared virtiofs filesystem and accesses host files directly.

Rootfs bridge (PoC artifact, not a real constraint)

When virtiofsd uses -o source=/ to serve the host root, the Kata agent looks for the container rootfs at /<container-id>/rootfs relative to the virtiofs root. The PoC pre-creates this directory on the host to keep the demonstration self-contained with ctr.

In a real Kubernetes attack, there are several ways to satisfy this without hostPath volumes. An initContainer that runs before the target container can create the directory. Alternatively, the attacker can set up a second pod that writes to a shared persistent volume mounted on the host. The rootfs bridge is a PoC convenience, not a limitation of the vulnerability itself.

Impact

An attacker who can create pods on a Kubernetes cluster using Kata Containers with default configuration…