CVE-2026-64676 Overview
CVE-2026-64676 is an authorization bypass vulnerability in Kata Containers, an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. The flaw affects the kata-agent component in Confidential Containers (CoCo) deployments prior to version 4.0.0. Two ttRPC methods introduced with the mem-agent feature bypass the OPA/Rego-based AgentPolicy authorization check that normally protects the confidential guest boundary. An untrusted host can invoke these methods unconditionally when mem-agent is enabled, tampering with in-guest memory management. The issue is fixed in version 4.0.0.
Critical Impact
An untrusted host can force swap, aggressive eviction, or compaction inside the confidential guest, degrading availability and performance of the workload outside the agent-policy security boundary.
Affected Products
- Kata Containers versions prior to 4.0.0
- Confidential Containers (CoCo) deployments using kata-agent
- Deployments where the mem-agent feature is explicitly enabled (off by default)
Discovery Timeline
- 2026-08-07 - CVE-2026-64676 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-64676
Vulnerability Analysis
The vulnerability is an authorization bypass classified under [CWE-862] Missing Authorization. In Confidential Containers deployments, the kata-agent enforces an OPA/Rego-based AgentPolicy that must authorize every ttRPC API call. This policy forms the security boundary preventing an untrusted host from directing the confidential guest.
Two ttRPC methods added with the mem-agent feature omit this authorization check. As a result, an untrusted host can invoke them regardless of the guest's policy configuration. The impact is bounded: it does not include memory disclosure or code execution, and it requires mem-agent to be explicitly enabled.
Root Cause
The root cause is missing policy enforcement on newly introduced ttRPC endpoints. When developers added mem-agent methods to the agent's ttRPC surface, they did not wire the calls through the AgentPolicy authorization gate that governs all other agent APIs. This creates an inconsistent security boundary where most ttRPC methods honor the policy while the memory management methods do not.
Attack Vector
An attacker with control over the untrusted host in a CoCo deployment sends ttRPC calls directly to the mem-agent methods on the confidential guest's kata-agent. Because these calls skip the OPA/Rego evaluation, the guest processes them unconditionally. The attacker can then force swap operations, aggressive memory eviction, or compaction inside the guest, degrading the availability and performance of the confidential workload.
The vulnerability requires local access to the host and no authentication on the ttRPC channel. Exploitation is limited to attacker-controlled availability and performance degradation. See the GitHub Security Advisory GHSA-h8jv-63p2-496x for technical details.
Detection Methods for CVE-2026-64676
Indicators of Compromise
- Unexpected invocations of mem-agent ttRPC methods on kata-agent endpoints from the host side
- Unexplained swap activity, memory eviction, or compaction events inside confidential guest workloads
- Performance degradation or latency spikes in CoCo workloads that correlate with host-side agent traffic
Detection Strategies
- Audit kata-agent versions across the cluster and flag any instance below 4.0.0 with mem-agent enabled
- Instrument ttRPC call telemetry on the guest to record method names and correlate them against expected policy-authorized operations
- Compare in-guest memory pressure metrics against workload baselines to identify anomalous eviction or compaction triggered externally
Monitoring Recommendations
- Collect and centralize kata-agent logs and ttRPC traces into a SIEM for cross-node correlation
- Alert on any mem-agent method invocation when the workload's policy does not expect memory tuning from the host
- Track kernel memory subsystem counters such as pgscan, pgsteal, and swap-in rates within confidential guests
How to Mitigate CVE-2026-64676
Immediate Actions Required
- Upgrade Kata Containers to version 4.0.0 or later, which adds the missing authorization checks
- If upgrade is not immediately possible, disable the mem-agent feature in the kata-agent configuration
- Inventory all CoCo deployments and confirm whether mem-agent is enabled, since the default is off
Patch Information
The issue is fixed in Kata Containers version 4.0.0. The patch adds the AgentPolicy authorization check to the two previously unguarded mem-agent ttRPC methods, bringing them in line with the rest of the agent's API surface. Refer to the GitHub Security Advisory GHSA-h8jv-63p2-496x for advisory details and release notes.
Workarounds
- Leave the mem-agent feature disabled, which is the default configuration and eliminates the exploitable surface
- Restrict host access in CoCo deployments to reduce the pool of principals capable of reaching the ttRPC endpoint
- Apply a hardened AgentPolicy and monitor for unexpected memory management activity until patching is complete
# Configuration example: verify mem-agent is disabled in kata configuration
grep -i 'mem[_-]agent' /etc/kata-containers/configuration.toml
# Upgrade to the fixed release
kata-runtime --version
# Ensure output shows 4.0.0 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
