KubeVirt virt-handler CVE-2026-13622

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-13622 for the official patched build of OpenShift Virtualization 4; no specific fixed version number was provided in the available intelligence data, so administrators should check the advisory directly for the exact errata package version and apply it via the OpenShift update channel. While awaiting a patch, the most actionable compensating control is to audit and restrict pods/exec RBAC permissions within namespaces running virtual machines: removing pods/exec from developer-tier roles directly breaks the attacker's ability to manipulate sockets inside virt-launcher pods. Additionally, enforcing namespace-level network policies and admission controls (such as requiring privileged pod annotations only for system namespaces) reduces the attack surface. Restricting live migration to maintenance windows with heightened monitoring provides detection opportunity. Note that restricting pods/exec may impact legitimate debugging workflows and should be weighed against operational requirements. Do not rely on pod security standards alone, as the privilege escalation path exploits virt-handler's root-in-host-namespace design rather than container escape via pod security misconfigurations.