# CVE-2026-12080: QEMU Guest Agent privilege escalation in guest-ssh-add-authorized-keys

Source: https://junglewise.ai/threats/cve-2026-12080-qemu-guest-agent-privilege-escalation-in-guest-ssh-add-authorized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-12080 · Severity: high · CVSS 7.3 · Published 2026-07-20

A security flaw has been identified in the QEMU Guest Agent, a background service used to manage virtual machines from a host server. A local user on a virtual machine could trick the system into changing the ownership of sensitive system files by using symbolic links. If successful, this allows a standard user to gain full administrative (root) control over the virtual machine, potentially leading to data theft or system disruption.

Vendors: [Qemu](https://junglewise.ai/threats/vendors/qemu).

## Quick answers

**Is CVE-2026-12080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12080 being exploited in the wild.

**How severe is CVE-2026-12080?** High severity, with a CVSS score of 7.3, published 20 July 2026.

**Which products and versions are affected?** QEMU Guest Agent unspecified.

**Is there a fix for CVE-2026-12080?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12080 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12080?** Check whether you run QEMU Guest Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw exists in the 'guest-ssh-add-authorized-keys' command handler of the QEMU Guest Agent (qga). The root-privileged agent performs directory checks that follow symbolic links and uses 'chown' instead of 'lchown' when managing a user's .ssh directory and authorized_keys file. A local unprivileged user can exploit this via a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) race condition. By pre-staging these paths as symlinks, the attacker can force the agent to transfer ownership of arbitrary root-owned files to the attacker's account. This requires an external management layer like libvirt to trigger the affected code path.

## Affected products

- QEMU QEMU Guest Agent unspecified
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected

## Timeline

- 2026-07-13: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-20: advisory: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-12080](https://access.redhat.com/security/cve/CVE-2026-12080)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2499603](https://bugzilla.redhat.com/show_bug.cgi?id=2499603)