A critical vulnerability in Kata Containers allows local guest users to achieve arbitrary code execution as root by modifying the guest micro VM file system.

This is a privilege escalation and code execution vulnerability occurring within the Cloud Hypervisor implementation. A local attacker with access to a container can manipulate the guest micro VM file system to execute arbitrary commands with root privileges.

The ability for a container user to escalate privileges to root within a Guest VM represents a critical security failure, justifying the 9.3 CVSS score. While the impact is largely contained to the specific micro VM, it undermines the isolation guarantees of the containerized environment, potentially leading to unauthorized data access and persistent local compromise.

Immediate Action: Upgrade all Kata Containers deployments to version 3.27.0 or later immediately to patch the hypervisor integration.

Proactive Monitoring: Review guest VM runtime logs for unexpected file system modifications or anomalous process execution by non-privileged accounts.

Compensating Controls: Ensure strict container resource limits and, where applicable, avoid running untrusted code within multi-tenant Kata environments until patching is complete.

Public Exploit Available: False

This vulnerability represents a significant breach of container isolation boundaries. Given the potential for root-level code execution within the guest environment, organizations should prioritize updating to version 3.27.0 in all production clusters to restore security parity.