EUVD-2026-39594
GHSA-q3jc-42cq-33fj
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
Local vector and low privileges reflect container-level access requirement; high complexity captures symlink timing window; scope change applies due to host filesystem impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.
AnalysisAI
Symlink-following in KubeVirt's virt-handler permits a container-level attacker to overwrite arbitrary host files and change their ownership. An attacker with access to the virt-launcher container can plant a symlink at the network cache file path expected by the WriteToCachedFile function; virt-handler then follows that symlink when calling os.WriteFile and os.Chown, enabling writes of attacker-influenced JSON content to any path accessible by virt-handler on the host. This represents a partial container-to-host escape - a scope change from the container context to the underlying node - with no public exploit identified at time of analysis.
Technical ContextAI
KubeVirt enables running virtual machines within Kubernetes clusters. The virt-handler is a privileged DaemonSet pod running on each Kubernetes node with access to host namespaces and filesystem paths; virt-launcher is a less-privileged per-VM pod that houses the actual guest workload. The WriteToCachedFile function in virt-handler writes network cache data to a path rooted in the virt-launcher filesystem, using Go's os.WriteFile followed by os.Chown, without validating whether the target path is a symlink before performing I/O. This matches CWE-61 (UNIX Symbolic Link Following): the vulnerable code does not perform a pre-operation symlink check (e.g., os.Lstat or O_NOFOLLOW), allowing an attacker in the virt-launcher container to redirect virt-handler's privileged write operation to an arbitrary host file. The scope change (S:C in the CVSS vector) reflects that exploitation crosses the container/host boundary.
RemediationAI
The primary fix should be obtained from the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13218 and the upstream KubeVirt project; no specific patched version number was present in the available input data, so no exact fix version can be cited. Until a patch is applied, compensating controls include restricting access to the virt-launcher container to only explicitly trusted workloads, enforcing Kubernetes admission controls (e.g., Pod Security Standards at the Restricted or Baseline level) to reduce the population of principals that can interact with launcher pods, and reviewing RBAC policies to ensure only necessary service accounts have exec or attach access to virt-launcher containers. Note that these controls reduce exposure but do not eliminate the underlying symlink-following defect in virt-handler. Monitor the Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2492654 for upstream fix commits and released package versions.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to confi
A flaw was found in kubevirt 0.29 and earlier. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploi
KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.2), this vulnerability is re
Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick t
KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for an
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning fea
Server-side request forgery in KubeVirt's virt-api port-forward handler allows authenticated Kubernetes users with kubev
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command
KubeVirt is a virtual machine management add-on for Kubernetes. Rated high severity (CVSS 8.5), this vulnerability is no
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code av
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Micro 5.3 | Affected |
| SUSE Linux Enterprise Micro 5.4 | Affected |
| SUSE Linux Enterprise Micro 5.5 | Affected |
| SUSE Linux Enterprise Module for Containers 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.0 | Affected |
| SUSE Linux Micro 6.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Containers 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Containers 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap Micro 5.3 | Affected |
| openSUSE Leap Micro 5.4 | Affected |
| openSUSE Leap Micro 5.5 | Affected |
| SUSE Linux Micro Extras 6.0 | Affected |
| SUSE Linux Micro Extras 6.1 | Affected |
| SUSE Linux Micro Extras 6.2 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today