CVE-2026-47243: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-47243 is a guest-root to host-root container escape vulnerability in Kata Containers' runtime-rs standalone virtio-fs path, allowing an attacker with root-equivalent access inside a Kata guest VM to execute arbitrary code as host root. It affects all Kata Containers versions prior to 3.31.0 (≤ 3.30.0). The vulnerability was first reported on May 21, 2026, with a patch released in version 3.31.0 and the advisory published to the GitHub Advisory Database on May 27, 2026. It carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Kata Advisory).

The root cause is that the runtime-rs standalone virtio-fs configuration launches the host virtiofsd daemon as root with --sandbox none --seccomp none, removing all sandboxing and seccomp restrictions (CWE-22, CWE-36). An attacker with guest-root access can bypass the guest kernel's virtio-fs client entirely by directly accessing the virtio-fs PCI device, memory-mapping the PCI BAR, recovering guest physical addresses via /proc/self/pagemap, and constructing a custom virtqueue in userspace to submit raw FUSE requests to the host virtiofsd. The critical primitive is FUSE_SYMLINK: the attacker crafts a request where the new symlink name is an absolute host path (e.g., /etc/cron.d/kata-go-escape-cron-<id>), which virtiofsd honors outside the configured shared directory because it lacks path confinement enforcement. The symlink target is set to a guest-controlled crontab payload reachable via a live Kata runtime process's mount namespace (/proc/<pid>/root/run/kata-containers/shared/sandboxes/.../rootfs/tmp/kata-go-escape-payload), causing the host cron daemon to execute the payload as host root (Kata Advisory, oss-security).

Successful exploitation allows a guest-root attacker to fully escape the Kata Containers isolation boundary and execute arbitrary commands as host root, achieving complete compromise of the underlying host system. Both confidentiality and integrity of the host are fully impacted — the attacker can read sensitive host data, modify system files, install persistent backdoors, and pivot to other workloads or infrastructure running on the same host. Availability of the host is not directly impacted by the escape mechanism itself, but subsequent attacker actions could cause denial of service. The vulnerability is verified to work with both QEMU and Cloud Hypervisor hypervisors in the affected configuration (Kata Advisory, GitHub Advisory).

A proof-of-concept (PoC) exploit exists and was included in the original security advisory, demonstrating end-to-end guest-root to host-root code execution via a containerized image (kata-go-escape:local) (Kata Advisory). NVD's SSVC assessment classifies exploitation status as "poc" with total technical impact, though it is not automatable. The EPSS score is approximately 0.067%–0.181%, indicating a currently low but non-negligible probability of exploitation in the wild. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory).

1. Gain guest-root access: Obtain root-equivalent execution inside a Kata Containers guest VM running the runtime-rs virtio-fs configuration (e.g., via a privileged container or container escape from a lower-privileged context).
2. Locate the virtio-fs PCI device: Enumerate /sys/devices/pci0000:00/ inside the guest to identify the virtio-fs PCI device (e.g., /sys/devices/pci0000:00/0000:00:05.0).
3. Take over the virtqueue: Memory-map the virtio PCI BAR and use /proc/self/pagemap to recover guest physical addresses, then construct a custom virtqueue in userspace to communicate directly with the host virtiofsd, bypassing the guest kernel's FUSE client.
4. Send FUSE_INIT: Initialize the FUSE session with the host virtiofsd by sending a raw FUSE_INIT request through the attacker-controlled virtqueue.
5. Discover the sandbox path: Send FUSE lookup requests to enumerate the current runtime-rs sandbox ID under the passthrough/ directory and locate the guest payload path (e.g., passthrough/<sandbox_id>/rootfs/tmp/kata-go-escape-payload).
6. Write the cron payload: Write a malicious crontab payload to a guest-accessible path such as /tmp/kata-go-escape-payload inside the guest.
7. Send FUSE_SYMLINK with absolute host path: Craft and submit a raw FUSE_SYMLINK FUSE request where the new symlink name is an absolute host path (e.g., /etc/cron.d/kata-go-escape-cron-<id>) and the symlink target is /proc/<kata-runtime-pid>/root/run/kata-containers/shared/sandboxes/<sandbox_id>/ro/passthrough/<sandbox_id>/rootfs/tmp/kata-go-escape-payload. The unsandboxed virtiofsd creates the symlink on the host filesystem.
8. Wait for cron execution: Keep the guest alive while the host cron daemon scans /etc/cron.d, follows the root-owned symlink, loads the guest-controlled crontab payload, and executes it as host root, completing the sandbox escape (Kata Advisory, GitHub Advisory).

• File System: Unexpected symlinks in /etc/cron.d/ with names matching patterns like kata-go-escape-cron-* or other unusual entries pointing to /proc/<pid>/root/... paths; new or modified files in /run/ created by the cron daemon (e.g., /run/kata-go-escape.proof) owned by root but not attributable to normal system processes.
• Logs: Cron daemon log entries (/var/log/syslog or journalctl -u cron) showing execution of unexpected jobs from /etc/cron.d/ entries that resolve through /proc/<pid>/root/ symlink targets; virtiofsd logs showing FUSE_SYMLINK requests with absolute path names outside the configured --shared-dir.
• Process: Unusual child processes spawned by the cron daemon (e.g., reverse shells, curl, wget, bash) not associated with legitimate scheduled tasks; virtiofsd process receiving FUSE requests from unexpected sources or exhibiting abnormal I/O patterns.
• Network: Unexpected outbound connections from the host originating from cron-spawned processes to external IPs, potentially indicating reverse shell or data exfiltration activity following successful exploitation (Kata Advisory).

Upgrade Kata Containers to version 3.31.0 or later, which fixes the vulnerability by correcting virtiofsd path confinement enforcement (oss-security, Kata Advisory). The fix commit is 555b7738fe2f699af6d57712cf75330f012b4e3b. As interim workarounds: disable the standalone virtio-fs shared filesystem configuration if not required; configure virtiofsd with appropriate --sandbox and --seccomp restrictions enabled; and restrict root-level access inside guest VMs where possible. Avoid using rootless = false with shared_fs = "virtio-fs" in the runtime-rs QEMU configuration until patched.

The vulnerability was disclosed publicly via the oss-security mailing list on May 21, 2026, by Aurelien Bombo of the Kata Containers Vulnerability Management Team, with a clear description and references to the fix (oss-security). Security news outlet SecurityOnline.info covered the vulnerability shortly after the advisory was published (GitHub Advisory). The issue was also noted on the Lobsters community feed and tracked by CERT.at in their daily security briefings. The vulnerability was credited to reporter JulesDT, with remediation developed by sprt and reviewed by fidencio and stevenhorsman from the Kata Containers project.