Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command‑line arguments into the virtiofsd process through the io.katacontainers.config.hypervisor.virtio_fs_extra_args pod annotation. By injecting -o source=/ along with --no-announce-submounts and --sandbox=none, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the kernel_params annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue.

The vulnerable product is Kata Containers (kata-containers). All releases prior to version 3.31.0 are affected. The patch is 3.31.0 and later.

The CVSS score of 5.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to create a pod with the default‑enabled annotations and therefore is limited to environments where pod creation is permitted to potentially malicious actors or compromised users.