5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44210

CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Kata Containers ships with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

Details

The default Kata configuration at configuration.toml line 1 contains:

enable_annotations = ["enable_iommu", "virtio_fs_extra_args", "kernel_params", "kernel_verity_params"]

Both virtio_fs_extra_args and kernel_params are enabled out of the box. The annotation name is checked against this allowlist, but the annotation value (the actual arguments) is never validated or filtered.

In utils.go at line 981, the runtime parses the annotation value as a JSON string array and appends it directly to the virtiofsd arguments:

if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSExtraArgs]; ok {
    var parsedValue []string
    err := json.Unmarshal([]byte(value), &parsedValue)
    // ...
    sbConfig.HypervisorConfig.VirtioFSExtraArgs = append(
        sbConfig.HypervisorConfig.VirtioFSExtraArgs, parsedValue...)
}

In virtiofsd.go at line 183-198, the runtime builds the virtiofsd command line with --shared-dir=<kata_managed_path> first, then appends the extra args:

args := []string{
    "--syslog",
    "--cache=" + v.cache,
    "--shared-dir=" + v.sourcePath,
    fmt.Sprintf("--fd=%v", FdSocketNumber),
}
if len(v.extraArgs) != 0 {
    args = append(args, v.extraArgs...)
}

The virtiofsd binary (Rust, from gitlab.com/virtio-fs/virtiofsd) supports a compatibility option that overrides the value. This is processed after clap argument parsing, in the function at main.rs:462:

Miggo Vulnerability Database

→

CVE-2026-44210

CVE-2026-44210:

5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kata-containers/kata-containers	go	< 0.0.0-20260519062212-ffa59ce3aa78	0.0.0-20260519062212-ffa59ce3aa78

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Kata Containers, by default, allows pod creators to inject command-line arguments into the virtiofsd process via the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. The values passed to this annotation are not sanitized.

The exploit involves two main stages, corresponding to the identified vulnerable functions:

Argument Injection: The virtcontainers.CreateSandbox function is responsible for setting up a new sandbox. Within this function, it reads the pod annotations. If the virtio_fs_extra_args annotation is present, its value is parsed as a list of strings and stored in the sandbox configuration. No validation is performed on these strings, allowing an attacker to inject arbitrary arguments.
Command Execution: The virtiofsd.Start function is called to start the virtiofsd daemon. This function constructs the command-line arguments for the daemon. It appends the extra arguments from the sandbox configuration (which were injected in the previous step) to the command. An attacker can inject "-o", "source=/" which overrides the intended shared directory, causing virtiofsd to share the entire host root filesystem with the guest VM.

By combining this with another default-enabled annotation (kernel_params) to enable a debug console, an attacker can gain a root shell in the VM, mount the exposed host filesystem, and achieve a full VM escape, leading to arbitrary file read/write on the host.

Vulnerable functions

virtcontainers.CreateSandbox

src/runtime/virtcontainers/virtcontainers.go

This function processes pod annotations. When the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` annotation is enabled, this function parses its value as a JSON string array and appends it to the `VirtioFSExtraArgs` field of the sandbox configuration. There is no validation or filtering of the annotation value, allowing an attacker to inject arbitrary arguments for the `virtiofsd` process.

virtiofsd.Start

src/runtime/virtcontainers/virtiofsd.go

This function constructs the command line for the `virtiofsd` daemon. It appends the `extraArgs`, which are populated from the pod annotations by `CreateSandbox`, to the command line. Because the arguments are appended after the `--shared-dir` argument, an attacker can use `-o source=/` to override the shared directory and mount the host's root filesystem into the VM.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Details

CVE-2026-44210:

5.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.8

5.8

CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Details

Basic Information

Basic Information

Rootfs bridge (PoC artifact, not a real constraint)

Impact

Steps to reproduce

Proof of concept output

5.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Details

CVE-2026-44210:

5.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.8

5.8

CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Summary

Details

Basic Information

Basic Information

Rootfs bridge (PoC artifact, not a real constraint)

Impact

Steps to reproduce

Proof of concept output

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI