CVE-2020-27151

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-12-07 · updated 2026-06-17

Description

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on the worker nodes.

Affected products

kata-containers: through 1.11.3; 2.0.0-alpha1, 2.0.0-alpha2, 2.0.0-alpha3, 2.0.0-rc0, 2.0.0-rc1

References

https://bugs.launchpad.net/katacontainers.io/+bug/1878234
https://github.com/kata-containers/kata-containers/releases/tag/2.0.0
https://github.com/kata-containers/runtime/releases/tag/1.11.5
https://github.com/kata-containers/runtime/releases/tag/1.12.0
https://bugs.launchpad.net/katacontainers.io/+bug/1878234
https://github.com/kata-containers/kata-containers/releases/tag/2.0.0
https://github.com/kata-containers/runtime/releases/tag/1.11.5
https://github.com/kata-containers/runtime/releases/tag/1.12.0

Get alerted when CVE-2020-27151 or the next vulnerability affects your stack