OESA-2026-3653

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3653

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3653.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-3653

Upstream

CVE-2026-50540

Published

2026-09-05T15:03:31Z

Modified

2026-09-05T15:16:34.006935058Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

kata-containers-go security update

Details

This is core component of Kata Container, to make it work, you need a isulad/docker engine.

Security Fix(es):

A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.config_path annotation to an arbitrary configuration file on the host. This allows the attacker to control privileged runtime settings, leading to the execution of malicious binaries as root on the host system. The primary consequence is arbitrary code execution with elevated privileges.(CVE-2026-50540)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:24.03-LTS-SP3 / kata-containers-go

Package

Name: kata-containers-go
Purl: pkg:rpm/openEuler/kata-containers-go&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.1-35.oe2403sp3

Ecosystem specific

{
    "x86_64": [
        "kata-containers-go-1.11.1-35.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-go-1.11.1-35.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "kata-containers-go-1.11.1-35.oe2403sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3653.json"