CVE-2026-77176

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.

• CWE-73

• https://access.redhat.com/security/cve/CVE-2026-77176
• https://bugzilla.redhat.com/show_bug.cgi?id=2517502
• https://github.com/kata-containers/kata-containers/security/advisories/GHSA-fmg6-v47x-52wr
• https://www.openwall.com/lists/oss-security/2026/08/20/19

Published

Aug 20, 2026

Last Modified

Oct 31, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77169A vulnerability in the team folders (formerly group folders)…6.5
• CVE-2026-7717A vulnerability was determined in Totolink WA300 5.2cu.7112_…8.8
• CVE-2026-77170The Deck config API allows authenticated users to set board-…4.3
• CVE-2026-77171A public shared collective always allowed recipients of the …3.5
• CVE-2026-77172App passwords were allowed to bypass password confirmation o…5.3
• CVE-2026-77173A user could create a docx or odt file with a # in the filen…4.3
• CVE-2026-77177Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Met…9.8
• CVE-2026-77178Oracle VM VirtualBox before 7.2.8 allows guest OS users to c…9.1
• CVE-2026-77179On macOS, the virtio-fs host server used by Docker Sandboxes…9.4
• CVE-2026-7718A vulnerability was identified in Totolink WA300 5.2cu.7112_…6.3
• CVE-2026-77180When NGINX Ingress Controller is configured with Ingress ann…8.3
• CVE-2026-77181Incorrect Authorization vulnerability in Apache Syncope. …9.8