Do Son 
TL;DR
CVE-2026-77176 is a CVSS 8.1 flaw in Kata Containers genpolicy. A malicious operator can mount arbitrary guest rootfs paths onto sensitive locations. Only Confidential Containers setups are affected. No exploitation in the wild or public proof-of-concept has been confirmed.
- CVE: CVE-2026-77176
- CVSS: 8.1 (High · CVSSv3)
- Product: Red Hat OpenShift Container Platform 4
- Impact: Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why CVE-2026-77176 Matters
Kata Containers runs workloads inside lightweight VMs. Confidential Containers builds on that to shield the guest from an untrusted host. The genpolicy tool enforces that boundary. This flaw weakens it. As a result, a hostile operator can undermine the very isolation the model promises. The official GitHub Security Advisory documents the full scope.
How the Attack Works
The weakness sits in genpolicy’s generated Rego rules. The policy failed to validate mount and storage rules tightly enough. Because of that gap, a malicious operator can craft CreateContainer requests. These requests then mount attacker-chosen guest paths onto trusted targets.
Affected targets include /etc/hostname, /etc/hosts, and /etc/resolv.conf. They also cover Kubernetes service account and Azure token paths. Furthermore, an attacker can plant arbitrary content in /dev/shm and /dev/termination-log. An app that trusts these paths could leak secrets or accept tampered data.
Affected Versions and Scope
The issue affects Kata releases before 4.1.0 that use genpolicy. Standard Kata sandboxing is not affected. Only Confidential Containers deployments carry the risk.
Patch and Mitigation Steps
Upgrade to Kata Containers 4.1.0, which contains the fix. There is no separate patch release. If you cannot upgrade yet, apply a workaround. Use the rules.rego file from 4.1.0, or apply the upstream commit by hand. The fix stops genpolicy from matching image pull storages to mounts.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
