CVE-2026-41326General(katacontainers / confidential_containers)

LOWCVSS 8.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers; even those running inside CVMs. This vulnerability is fixed in v3.29.0.

katacontainers CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/kata-containers/kata-containers/commit/1b9e49eb2763aa6ea6a99b276d3ff5e2c7f658f2

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-61CWE-1220

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

confidential_containers
kata_containers

Threat summary

Public PoC is present in monitored signal
4 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 3d ago at 1 mentions (2026-04-24); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

katacontainers

Products

confidential_containerskata_containers

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

General

250.0%

Disclosure

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-24	1	General1
2026-04-25	1	General1
2026-05-04	1	Disclosure1
2026-05-15	1	Disclosure1

Full discourse4 posts

Open Source Security mailing list@oss_security147d
Disclosure
CVE-2026-41326: Kata Containers: CopyFile Policy Subversion via Symlinks https://www.openwall.com/lists/oss-security/2026/05/13/2 allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers.
Post summary
The text announces CVE-2026-41326, a Kata Containers flaw that allows untrusted hosts to overwrite files inside a guest via symlinks, potentially enabling binary replacement and data exfiltration, with a reference link for more details.
01021430
4.7K followersView on X
DailyCVE@dailycve157d
Disclosure
🔴 Kata Containers, CopyFile Policy Subversion via Symlinks, #CVE-2026-41326 (High) https://dailycve.com/kata-containers-copyfile-policy-subversion-via-symlinks-cve-2026-41326-high/
Post summary
This post announces a new high‑severity CVE‑2026-41326 affecting Kata Containers, describing a CopyFile policy subversion via symlinks.
0000036
191 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds167d
General
CVE-2026-41326 Arbitrary File Write in Kata Containers CopyFile Policy Versions 3.4.0-3.28.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41326
Post summary
The entry identifies CVE-2026-41326 as an arbitrary file write flaw affecting Kata Containers policy versions 3.4.0-3.28.0, but offers no PoC, exploit, or patch details.
0000055
4.0K followersView on X
CVE@CVEnew167d
General
CVE-2026-41326 Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.… https://www.cve.org/CVERecord?id=CVE-2026-41326
Post summary
The text references CVE-2026-41326 for Kata Containers but provides no actionable information about the vulnerability, exploitation, or mitigations.
0000081
57.2K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	katacontainers	confidential_containers	-	-	-
App	katacontainers	kata_containers	-	-	-

Explore more

Back to dashboard katacontainers CVEs confidential_containers vulnerabilities

What researchers are saying

CVE-2026-41326

Open Source Security mailing list@oss_securityDisclosure

The text announces CVE-2026-41326, a Kata Containers flaw that allows untrusted hosts to overwrite files inside a guest via symlinks, potentially enabling binary replacement and data exfiltration, with a reference link for more details.

DailyCVE@dailycveDisclosure

This post announces a new high‑severity CVE‑2026-41326 affecting Kata Containers, describing a CopyFile policy subversion via symlinks.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The entry identifies CVE-2026-41326 as an arbitrary file write flaw affecting Kata Containers policy versions 3.4.0-3.28.0, but offers no PoC, exploit, or patch details.

CVE@CVEnewGeneral

The text references CVE-2026-41326 for Kata Containers but provides no actionable information about the vulnerability, exploitation, or mitigations.