QEMU Guest Agent CVE-2026-12080

Exploitation requires: (1) a local unprivileged shell inside the guest VM (PR:L); (2) the QEMU Guest Agent running as root in that guest with the guest-ssh-add-authorized-keys RPC enabled/allowlisted; and (3) an external management layer such as libvirt or the orchestrator actually invoking that command handler (UI:R) - the vulnerable code path is not self-triggered by the local attacker and is unreachable if the host never issues the SSH-key command. Limiting factors: the attack is strictly local (no network vector), the file-symlink variant is a TOCTOU race that is non-deterministic and may require multiple attempts, and environments that disable or never use guest-ssh-add-authorized-keys are not exposed. The deterministic directory-symlink variant removes the race timing requirement but still needs the management layer to call the handler.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.3, High) describes a local attack (AV:L) by an already-authenticated low-privileged guest user (PR:L) that yields full confidentiality, integrity, and availability impact by way of root file ownership. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation-probability signals are absent; the appropriate status is no public exploit identified at time of analysis and not actively exploited per available data. A tension worth flagging: the vector marks AC:L, but one of the two documented variants is a TOCTOU race whose file-symlink form is inherently non-deterministic and may not succeed on the first attempt - the deterministic directory-symlink variant is what justifies AC:L, while the race variant would realistically warrant AC:H. Another material gating factor not captured in the base score is the dependency on an external management layer (libvirt/orchestrator) actually invoking guest-ssh-add-authorized-keys - environments that never call this command are not reachable. Net: this is a genuine local root escalation for exposed configurations, but it is not an internet-facing or wormable issue and its practical priority is bounded by whether the SSH-key-injection feature is in use.

An unprivileged user with a shell inside a RHEL or OpenShift-hosted VM pre-plants a symbolic link in the path that guest-ssh-add-authorized-keys will operate on, then waits for (or induces) the libvirt-based management layer to trigger the SSH-key-injection command. The root-privileged agent follows the attacker's directory symlink - or, in the file variant, the attacker wins a TOCTOU race by swapping the target for a symlink mid-operation - causing root to take actions against an attacker-chosen file and handing the attacker ownership of a root-owned resource for full root escalation. No public POC is identified at time of analysis, and success depends on the management layer actually invoking the command.