Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Kata Containers may let low‑privilege users gain root
published 1 year ago
Summary
The Kata Containers component used in Azure can incorrectly add the root group to a user's access list when the user belongs to fewer than 1,024 groups. This mistake could let a regular user or process obtain administrator rights. Upgrade to the latest version of the package to fix the issue.
What to do
- Update azure kata-containers-cc to version 3.15.0.aks0-15.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kata-containers-cc |
< 3.15.0.aks0-15 Fix: upgrade to 3.15.0.aks0-15
|
Original advisory text
CVE-2025-5791 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
References
Timeline
Published6 Jun 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-63771 · OSV
Track software like this
Free during beta