# CVE-2026-13208: KubeVirt virt-handler improper authentication in domain notify server

Source: https://junglewise.ai/threats/cve-2026-13208-kubevirt-virt-handler-improper-authentication-in-domain-notify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-13208 · Severity: medium · CVSS 6.5 · Published 2026-06-24

A security flaw in KubeVirt, a tool for managing virtual machines within Kubernetes, allows a compromised virtual machine to interfere with others running on the same physical server. By sending forged messages to the management service, an attacker can disrupt the operations of neighboring virtual machines, potentially causing forced restarts or shutdowns. This issue primarily impacts the reliability and availability of virtualized workloads in shared environments.

Technologies: [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-13208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13208 being exploited in the wild.

**How severe is CVE-2026-13208?** Medium severity, with a CVSS score of 6.5, published 24 June 2026.

**Which products and versions are affected?** Red Hat Red Hat OpenShift Virtualization 4 4; KubeVirt virt-handler.

**Is there a fix for CVE-2026-13208?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13208 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-13208?** Check whether you run KubeVirt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in KubeVirt's virt-handler domain notify server within the HandleDomainEvent and HandleK8SEvent gRPC handlers. The server derives VMI identity (namespace and name) exclusively from the request body without verifying the connection's origin or using peer authentication (such as SO_PEERCRED). Because virt-launcher pods connect via per-VMI pipe sockets that lack identity tagging during the byte-pump process, a compromised virt-launcher can send forged lifecycle events for any other VMI scheduled on the same node. This results in unauthorized state updates in the Kubernetes API, leading to cross-tenant denial of service and lifecycle management disruption.

## Affected products

- Red Hat Red Hat OpenShift Virtualization 4 4
- KubeVirt virt-handler

## Timeline

- 2026-06-24: disclosed: Vulnerability published by Red Hat and NVD.

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-13208](https://access.redhat.com/security/cve/CVE-2026-13208)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2492220](https://bugzilla.redhat.com/show_bug.cgi?id=2492220)

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt authentication bypass in migration proxy when TLS is disabled](https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt SSRF in virt-api port-forward handler](https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)