Executive brief
A security flaw was found in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with access to a virtual machine's management container could trick the system into overwriting critical files on the underlying host server. This could lead to system instability or unauthorized changes to server configuration, although the attacker cannot fully control the content written to those files.
Technical details
A symlink following vulnerability (CWE-61) exists in KubeVirt's virt-handler network cache handling. The 'WriteToCachedFile' function in 'pkg/network/cache/cache.go' uses 'os.WriteFile' and 'os.Chown' on paths rooted in the launcher container without symlink protection (O_NOFOLLOW). An attacker with access to the virt-launcher container can create a symbolic link at the cache file path. Because virt-handler operates in the host mount namespace, it will follow the symlink and overwrite an arbitrary host file with JSON-formatted network cache data and change the file's ownership to UID 107. This vulnerability specifically affects bridge/non-masquerade network interfaces.
Affected products
- KubeVirt KubeVirt unspecified
- Red Hat Red Hat OpenShift Virtualization 4 4
Timeline
- 2026-06-25: disclosed: Vulnerability reported via Red Hat Bugzilla
- 2026-06-26: advisory: NVD publication date