EUVD-2026-89100
GHSA-x9f5-3f6m-x9jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain VMI-create RBAC in cluster
-
DeliverySubmit VM manifest with empty ephemeral volume
-
Exploitvirt-controller hits null pointer dereference
-
ExecutionController crashes and persisted object forces crash loop
-
ImpactCluster-wide VM lifecycle DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated principal holding Kubernetes RBAC permission to create VirtualMachineInstance (VMI) objects in a cluster running KubeVirt. The specific trigger is a VM/VMI definition containing an empty ephemeral volume, which virt-controller fails to validate. Exploitation is limited by: the need for valid cluster credentials and VMI-create authorization (PR:L, not anonymous), and the requirement that the target cluster actually runs KubeVirt with the vulnerable virt-controller. No user interaction and no special network configuration are needed beyond API-server reachability; the persisted malformed object is what makes the DoS durable (crash loop) rather than a one-shot crash. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and is internally consistent with the description: a network-reachable Kubernetes API, low attack complexity, and a low-privileged but authenticated actor (PR:L) who already holds RBAC permission to create VirtualMachineInstances. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a widespread-exploitation emergency. The impact is pure availability (C:N/I:N) with A:H justified by the persistent crash-loop of virt-controller that disrupts VM lifecycle operations cluster-wide. One notable tension: CVSS scope is marked S:U, yet the description states the crash disrupts operations 'across the entire environment,' affecting all tenants/namespaces served by that controller - a defender could reasonably argue S:C (scope change beyond the attacker's own authorization boundary), which would raise the score. Treat this as a real, prioritize-the-patch integrity-of-service issue for KubeVirt operators, especially in multi-tenant clusters, rather than a critical RCE-class emergency. |
| Exploit ScenarioDerived | An authenticated tenant with RBAC rights to create VMIs submits a VirtualMachine/VMI manifest containing a malformed empty ephemeral volume. virt-controller dereferences a null volume configuration and crashes; because the invalid object persists in etcd, the controller crash-loops on every reconcile, halting VM start/stop/migration for all users of the cluster. No public exploit code is identified at time of analysis, but the trigger is a trivially craftable manifest. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Denial of service in KubeVirt lets an authenticated user with permission to create VirtualMachineInstance (VMI) objects crash the virt-controller by submitting a VM definition containing an empty ephemeral volume; the controller hits a NULL pointer dereference and enters a persistent crash loop because the malformed object remains in the cluster, disrupting VM lifecycle operations environment-wide. The flaw is tracked as CVE-2026-102623 with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CWE-476; exploitation requires valid Kubernetes RBAC permissions and API-server reachability, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch is identified in the available data at time of analysis, so administrators should prioritize compensating controls. First, identify and delete any VirtualMachine or VirtualMachineInstance objects that contain an empty ephemeral volume-removing the malformed object breaks the virt-controller crash loop; trade-off is potential disruption to the intended VM workload. Second, tightly restrict Kubernetes RBAC permissions to create or modify VMI/VM objects to fully trusted principals only, since an authenticated user with that permission (PR:L) can trigger the flaw; this limits who can exploit it but requires ongoing RBAC review. Third, monitor virt-controller pod restarts and Kubernetes events for repeated panics, and consider an admission webhook to reject VM definitions with empty ephemeral volumes-this adds operational overhead and may block legitimate configurations if not carefully validated. Apply vendor updates as soon as a patched version is released; track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-102623 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2543219 for patch availability.
Affected ProductsAI
KubeVirt deployments running the vulnerable virt-controller are affected. The provided data does not specify exact affected version numbers or a CPE string; the flaw applies to any KubeVirt cluster where virt-controller fails to validate empty ephemeral volumes and where users can create VMI objects. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-102623 and the associated Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2543219 for vendor-specific affected product versions and update guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KubeVirt extends Kubernetes with custom resources to run virtual machines alongside containers; the virt-controller is a core control-plane component that reconciles VirtualMachineInstance (VMI) objects, including volume attachment. The vulnerability is a NULL pointer dereference (CWE-476) triggered when the controller processes a VMI or VM definition with an empty ephemeral volume-a volume source that should contain a reference but is left nil. Because validation is missing, the controller dereferences a null pointer, panics, and crashes. The Kubernetes API server persists the malformed object, so the controller repeatedly restarts and re-processes the same bad definition, creating a durable DoS. The CVSS vector confirms network attack vector, low privileges (PR:L), no user interaction, and high availability impact only (C:N/I:N/A:H), meaning no data confidentiality or integrity loss is expected.
Know when Kubevirt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated VMI-create RBAC gives PR:L over the network API with low complexity; impact is availability-only crash loop, so C:N/I:N/A:H; S:U kept to match vendor though cluster-wide blast radius argues S:C.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.5), this vulnerability is no
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to confi
A flaw was found in kubevirt 0.29 and earlier. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploi
KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.2), this vulnerability is re
Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick t
KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for an
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning fea
Server-side request forgery in KubeVirt's virt-api port-forward handler allows authenticated Kubernetes users with kubev
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command
Symlink-following in KubeVirt's virt-handler permits a container-level attacker to overwrite arbitrary host files and ch
Exploit-DB