AI security incident: Kata Container to Guest micro VM privilege escalation (GHSA-wwj6-vghv-5p64)

Incident date: February 19, 2026 | Published: February 25, 2026 | Source: GitHub Security Advisory | Classification confidence: 50%

This incident is part of the public archive and includes explicit AI-related signals from the cited source material. Review methodology.

Summary An issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understinding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). ### Details _Linux virtio-pmem_ The virtio-pmem probe path always registers the region as a generic pagemap that supports asynchronous flushes, but it never marks the region as read-only.

Why This Is AI-Related

This page is treated as AI-specific because the source material references copilot, which places the issue inside an AI workflow, model, assistant, or supporting dependency rather than a generic software bulletin.

copilot

Affected Workflow

Review AI plugins, copilots, model-serving helpers, CLI tools, and automation runtimes that execute system commands.

Likely Attack Path

An attacker can turn the vulnerable AI-adjacent component into a path for command execution on the host or service runtime.

Impact

The issue can create a path to command execution inside an AI-facing product, plugin, copilot, or supporting service runtime. Severity HIGH. Classification confidence 50%. Source channel GHSA.

Detection And Triage Signals

New shell or process activity from AI-facing services
Unexpected outbound connections or file writes after prompt or API activity
Privilege changes, container escapes, or suspicious job execution logs

Recommended Response

Identify every environment that runs the affected AI plugin, assistant, CLI, or supporting package.
Patch or isolate the vulnerable component and remove risky execution permissions while validation is in progress.
Review process execution, outbound connections, and file-write logs for signs of post-exploitation activity.

Compliance And Business Impact

Code execution paths create immediate risk of host compromise, credential theft, and downstream lateral movement.

Sources

GHSA source

Want alerts like this in real time?

Get notified with incident context, likely impact, and response guidance.

Get Notified