# Kata Container has CopyFile Policy Subversion via Symlinks

Kata genpolicy CopyFile only validates the symlink path, not its target, letting untrusted hosts write into guest container images and exfiltrate data.

- Payout: Research
- Severity: high
- Program: Kata Containers
- Found by: fitzthum, calonso-nv, fikriwahab, kodareef5
- Disclosed: 2026-05-04
- CVE: CVE-2026-41326
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-q49m-57vm-c8cc
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-q49m-57vm-c8cc
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity impact:rce kind:research platform:ghsa sev:high tech:go technique:source-review vuln:access-control vuln:path-traversal

**Target:** Kata Agent CopyFile API / genpolicy Rego policy
**Root cause:** The CopyFileRequest policy only regex-checks input.path against the shared dir and ignores the data field, which for symlink creation is the link target; a symlink placed in the shared dir can point anywhere in the guest image.
**Steps:**
1. Identify a target file in the guest container image, e.g. a binary the workload invokes.
2. Send a CopyFile request with `path` inside `/run/kata-containers/shared/containers/...` (passes the regex) and `data` set to the target file path, creating a symlink from the shared dir to the image file.
3. Send a second CopyFile request writing attacker data to the symlink path in the shared dir, which propagates through the symlink into the image.
4. Restart the container so the overwritten binary is invoked.
**How found:** Reviewed the genpolicy CopyFileRequest rule and noticed it only validates input.path via regex and directory-traversal check, while the CopyFile message has other fields (data, file_mode, uid, gid) unchecked; realized the agent's symlink-creation mode puts the target in data, so the path check is bypassable.
**Exploitation:** A malicious host uses the CopyFile API twice: first to create a symlink in the shared dir pointing at a file inside the guest image, then to write arbitrary bytes through that symlink, overwriting guest binaries and enabling data exfiltration from containers including CVMs.
**Escalation:** Overwriting invoked binaries yields code execution in the guest workload; symlinks can also target data files for exfiltration out of CVMs.
**Insight:** When a policy validates only one field of a multi-purpose API message, check whether other fields change semantics (here data becomes a symlink target); symlink-creation modes of file-copy APIs are a classic way to escape path allowlists.