Executive brief
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt
Affected products
- Go kubevirt.io/kubevirt
- Go github.com/kubevirt/kubevirt
Junglewise Threat Intelligence
CVE-2025-64436: GO-2025-4104 - KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt
CVE-2025-64436 · Severity: low · CVSS 3.1 · Published 2025-11-17
Technologies: kubevirt.io/kubevirt (Go). Vendors: Go.
Related threats
- KubeVirt path traversal in virt-exportserver via symlink escape
- KubeVirt virt-handler privilege escalation via symlink following
- KubeVirt incorrect RBAC evaluation via subresource name truncation
- GO-2026-4384 - KubeVirt Guest Agent DoS via Excessive Network Interface Reports in kubevirt.io/kubevirt
- GO-2025-4103 - KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt