Skip to main content

KubeVirt CVE-2026-13201

| EUVDEUVD-2026-39086 HIGH
UNIX Symbolic Link (Symlink) Following (CWE-61)
2026-06-24 secalert@redhat.com GHSA-rcfc-7m3g-h5xh
Information Disclosure Red Hat Kubevirt Openshift Virtualization
7.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
vuln.today AI
7.3 HIGH

Attacker needs control of a virt-launcher pod (PR:L, AV:L); symlink redirect crosses the pod-to-host boundary (S:C) causing host file modification (I:L) and potential node disruption (A:H), with no data disclosure (C:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
SUSE
5.2 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jun 26, 2026 - 00:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 26, 2026 - 00:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 26, 2026 - 00:22 vuln.today
cvss_changed
Severity Changed
Jun 26, 2026 - 00:22 NVD
MEDIUM HIGH
CVSS changed
Jun 26, 2026 - 00:22 NVD
5.2 (MEDIUM) 7.3 (HIGH)
Analysis Generated
Jun 24, 2026 - 21:42 vuln.today

DescriptionCVE.org

A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream helpers operate via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to cause virt-handler to apply file ownership or permission changes to an unintended host path.

AnalysisAI

Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick the privileged virt-handler into applying file ownership or permission changes to unintended host paths. The OpenAtNoFollow safeguard is defeated because downstream helpers re-open the descriptor through /proc/self/fd/N with link-following syscalls, so a symlink at the path leaf is dereferenced. There is no public exploit identified at time of analysis, EPSS is very low (0.12%), and CISA SSVC marks exploitation as none.

Technical ContextAI

KubeVirt runs virtual machines as pods on Kubernetes, splitting work between an unprivileged per-VM virt-launcher pod and a privileged node agent, virt-handler, that performs host-level file operations on behalf of those pods. The safepath package is meant to enforce safe, no-follow path resolution: OpenAtNoFollow uses O_PATH|O_NOFOLLOW to grab a descriptor to the final path component without traversing a symlink. The flaw (CWE-61, UNIX symbolic link following) is a classic TOCTOU/indirection gap - the O_PATH descriptor is later used by referencing /proc/self/fd/N with syscalls that DO follow links, so if the leaf is attacker-controlled and is a symlink, the kernel resolves it and operations land on the symlink target instead of the intended file. This converts an intended sandboxed file operation into one that can reach paths outside the pod's boundary on the host.

RemediationAI

No vendor-released patch version is identified at time of analysis; the available references (Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13201 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492203) should be monitored for the fixed KubeVirt release, and you should upgrade to it as soon as it is published. As compensating controls while unpatched: tighten who can create or control virt-launcher pods by restricting namespaces and RBAC so untrusted tenants cannot schedule workloads onto sensitive nodes (trade-off: limits multi-tenant flexibility); apply Kubernetes Pod Security Standards and SELinux/AppArmor confinement to virt-launcher pods to reduce what a compromised pod can stage on shared mounts (trade-off: may require policy tuning to avoid breaking VM features); and minimize or isolate host paths shared between pods and virt-handler so a redirected operation has fewer high-value targets (trade-off: some storage/hotplug workflows may be affected). Do not rely on the safepath no-follow guarantee as a security boundary until the fix is applied.

More in Kubevirt

View all
CVE-2025-64436 MEDIUM POC
6.9 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is

CVE-2019-3841 MEDIUM POC
6.8 Mar 25

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when

CVE-2022-1798 MEDIUM POC
6.5 Sep 15

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to confi
CVE-2020-14316 CRITICAL
9.9 Jul 29

A flaw was found in kubevirt 0.29 and earlier. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploi
CVE-2023-26484 HIGH
8.2 Mar 15

KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.2), this vulnerability is re
CVE-2026-13208 MEDIUM
6.5 Jun 24

KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for an
CVE-2019-10175 MEDIUM
6.5 Jun 28

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning fea
CVE-2026-13318 MEDIUM
6.4 Jun 26

Server-side request forgery in KubeVirt's virt-api port-forward handler allows authenticated Kubernetes users with kubev
CVE-2024-33394 MEDIUM
5.9 May 02

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command

CVE-2026-13218 MEDIUM
4.2 Jun 26

Symlink-following in KubeVirt's virt-handler permits a container-level attacker to overwrite arbitrary host files and ch
CVE-2025-64324 HIGH POC
8.5 Nov 18

KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.5), this vulnerability is no
CVE-2025-64437 MEDIUM POC
5.0 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code av

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2024-22014 HIGH POC
8.8
CVE-2025-52565 HIGH POC
8.4
CVE-2026-39860 HIGH POC
8.4
CVE-2026-54574 HIGH POC
8.2
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-13201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy