OpenShift Virtualization EUVD-2026-39796

Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13434 for a patched release; no specific fixed version was confirmed in available data at time of analysis, and the Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2493576 should be tracked for patch availability. The most effective immediate compensating control is to ensure the ExternalNetResourceInjection Beta feature gate remains disabled (its default state) - clusters that have not explicitly enabled it are not exploitable via this path and require no further action. If the feature gate must remain enabled for operational workflows, restrict kubevirt.io:edit permissions to fully trusted, vetted tenants and audit all existing VirtualMachineInstance network annotations for unexpected JSON-formatted networkName values. Supplementary network-layer controls such as Kubernetes NetworkPolicies scoped to tenant namespaces and VLAN-level isolation between tenant and administrative network segments can limit the blast radius of cross-namespace attachment. Note that disabling the feature gate may break workloads that depend on external network resource injection behavior - validate in a staging environment before applying to production.