Skip to main content

KubeVirt CVE-2026-13208

| EUVDEUVD-2026-39087 MEDIUM
Improper Authentication (CWE-287)
2026-06-24 secalert@redhat.com GHSA-72r2-m3hg-cvf5
Authentication Bypass Kubevirt Openshift Virtualization
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

AV:L because exploitation requires process execution on the node; PR:L because a compromised virt-launcher (low-privilege process) is needed; S:C and A:H because forged events disrupt VMIs outside the attacker's own workload.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 24, 2026 - 21:42 vuln.today

DescriptionCVE.org

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI's state and disrupt its lifecycle management.

AnalysisAI

KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for any other VMI scheduled on the same Kubernetes node, causing virt-handler to corrupt that VMI's state and disrupt its lifecycle management. The root cause is that gRPC handlers for HandleDomainEvent and HandleK8SEvent accept VMI namespace/name exclusively from the request body, never cross-checking against the per-VMI pipe socket the connection arrived on. With CVSS 6.5 (AV:L/S:C), the attack requires local access via a compromised container but can impact multiple VMIs across tenants on the same node; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

KubeVirt extends Kubernetes to manage virtual machine workloads; virt-handler is a privileged DaemonSet pod running on each cluster node and acts as the lifecycle orchestrator for all VMIs scheduled there. Each VMI gets a corresponding virt-launcher pod that runs the QEMU/libvirt process and communicates with virt-handler through a dedicated Unix pipe socket whose path encodes the VMI's identity. The domain notify server within virt-handler exposes two gRPC endpoints - HandleDomainEvent and HandleK8SEvent - which accept lifecycle event messages. The flaw (CWE-287, Improper Authentication) is that neither handler extracts or validates the caller's identity from the socket path; instead, both trust the namespace and name fields supplied inside the gRPC message body. Because the pipe path's identity is never propagated to the request handlers, any process that can connect to the notify server can claim to be any VMI on the node. This breaks the implicit authentication boundary that the per-VMI socket topology was presumably intended to enforce.

RemediationAI

No specific patch version was included in the available intelligence data; the primary reference for fix status is https://access.redhat.com/security/cve/CVE-2026-13208, which should be consulted for updated patch information. Until a patched release is confirmed, operators should treat node-level isolation as the primary compensating control: restrict which workloads are co-scheduled with sensitive VMIs on the same nodes using Kubernetes node affinity and taint/toleration rules, reducing the blast radius if a virt-launcher is compromised. Additionally, harden the virt-launcher pod's security context (drop unnecessary Linux capabilities, enforce seccomp profiles, and apply PodSecurity admission restrictions) to raise the bar for initial compromise - noting that these controls do not eliminate the underlying identity-validation flaw. Network policies should be reviewed to ensure no lateral paths allow unauthorized processes to reach the virt-handler socket directory. Monitor KubeVirt release notes and the linked Bugzilla ticket for a fix that propagates pipe path identity into gRPC handler context.

More in Kubevirt

View all
CVE-2025-64436 MEDIUM POC
6.9 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is

CVE-2022-1798 MEDIUM POC
6.5 Sep 15

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to confi
CVE-2020-14316 CRITICAL
9.9 Jul 29

A flaw was found in kubevirt 0.29 and earlier. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploi
CVE-2023-26484 HIGH
8.2 Mar 15

KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.2), this vulnerability is re
CVE-2026-13201 HIGH
7.3 Jun 24

Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick t
CVE-2026-13318 MEDIUM
6.4 Jun 26

Server-side request forgery in KubeVirt's virt-api port-forward handler allows authenticated Kubernetes users with kubev
CVE-2024-33394 MEDIUM
5.9 May 02

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command

CVE-2026-13218 MEDIUM
4.2 Jun 26

Symlink-following in KubeVirt's virt-handler permits a container-level attacker to overwrite arbitrary host files and ch
CVE-2025-64324 HIGH POC
8.5 Nov 18

KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.5), this vulnerability is no
CVE-2025-64437 MEDIUM POC
5.0 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code av
CVE-2025-64435 MEDIUM POC
5.3 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is

CVE-2025-64434 MEDIUM POC
4.7 Nov 07

KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code av

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-13208 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy