CVE-2020-2026 - CVE House

Back to Database

Status published High CVE-2020-2026

Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path

7.8 CVSS

Vulnerability Description

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-2026

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Yuval Avrahami, Palo Alto Networks

References

More from Kata Containers

View All →

Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file

Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host

Kata Containers - Containers have access to the guest root filesystem device

Affected Vendor

Kata Containers

View all reports →

Affected Software

Kata Containers

Vulnerable Versions:

1.11, 1.10, 1

Timeline

Official Publish: June 10th, 2020

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1222 File and Directory Permissions Modification

Defense Evasion

T1005 Data from Local System

T1565 Data Manipulation

T1078 Valid Accounts