Executive brief
A security flaw in KubeVirt, a tool for managing virtual machines within Kubernetes, allows a compromised virtual machine to interfere with others running on the same physical server. By sending forged messages to the management service, an attacker can disrupt the operations of neighboring virtual machines, potentially causing forced restarts or shutdowns. This issue primarily impacts the reliability and availability of virtualized workloads in shared environments.
Technical details
A vulnerability exists in KubeVirt's virt-handler domain notify server within the HandleDomainEvent and HandleK8SEvent gRPC handlers. The server derives VMI identity (namespace and name) exclusively from the request body without verifying the connection's origin or using peer authentication (such as SO_PEERCRED). Because virt-launcher pods connect via per-VMI pipe sockets that lack identity tagging during the byte-pump process, a compromised virt-launcher can send forged lifecycle events for any other VMI scheduled on the same node. This results in unauthorized state updates in the Kubernetes API, leading to cross-tenant denial of service and lifecycle management disruption.
Affected products
- Red Hat Red Hat OpenShift Virtualization 4 4
- KubeVirt virt-handler
Timeline
- 2026-06-24: disclosed: Vulnerability published by Red Hat and NVD.