CVE-2026-64676

Received Received - Intake

Authorization Bypass in Kata Containers mem-agent

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers (CoCo) deployments, the kata-agent enforces an OPA/Rego-based AgentPolicy that must authorize every ttRPC API call, forming the security boundary that prevents an untrusted host from directing the confidential guest. Two ttRPC methods introduced with the mem-agent feature are missing this authorization check, so an untrusted host can invoke them unconditionally regardless of the guest's policy configuration. When mem-agent is enabled (off by default), this lets the host tamper with in-guest memory management by forcing swap, aggressive eviction, or compaction, resulting in attacker-controlled availability and performance degradation of the confidential workload entirely outside the agent-policy boundary. The impact does not include memory disclosure or code execution, and severity is bounded by the precondition that mem-agent must be explicitly enabled. This issue is fixed in version 4.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-64676

Affected Vendors & Products

Vendor	Product	Version / Range
kata_containers	kata_agent	to 4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Kata Containers prior to 4.0.0 has an authorization bypass in confidential-guest memory management. The kata-agent enforces an OPA/Rego-based AgentPolicy to authorize ttRPC API calls, but two methods introduced with the mem-agent feature lack this check. This allows an untrusted host to invoke these methods without authorization when mem-agent is enabled, potentially tampering with in-guest memory management.

Detection Guidance

Check if Kata Containers version is prior to 4.0.0 using 'kata-runtime --version'. Verify if mem-agent is enabled in kata-agent configuration files. Inspect kata-agent logs for unauthorized ttRPC API calls related to memory management.

Impact Analysis

If mem-agent is enabled, an attacker controlling the host can force memory operations like swap, eviction, or compaction. This could degrade performance or availability of the confidential workload, but does not allow memory disclosure or code execution.

Compliance Impact

This vulnerability primarily impacts availability and performance of confidential workloads rather than confidentiality or integrity of data. It does not directly cause memory disclosure or code execution, which are common focus areas for GDPR and HIPAA compliance. However, denial-of-service risks from tampered memory management could indirectly affect service availability, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade Kata Containers to version 4.0.0 or later. If mem-agent is enabled, disable it in the kata-agent configuration. Review and enforce AgentPolicy rules to ensure all ttRPC API calls are authorized.

Hi! I’m here to help you understand CVE-2026-64676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70