Is CVE-2026-13218 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13218 being exploited in the wild.

How severe is CVE-2026-13218?

Medium severity, with a CVSS score of 4.2, published 26 June 2026.

Which products and versions are affected?

kubevirt.io/kubevirt (Go) <= 1.10.0-rc.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.10.0-rc.0; KubeVirt unspecified.

Is there a fix for CVE-2026-13218?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13218 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-13218?

Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13218: KubeVirt virt-handler symlink following in WriteToCachedFile

Q: Is there a fix for CVE-2026-13218?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-13218 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-13218?

Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13218 · Severity: medium · CVSS 4.2 · Published 2026-06-26

A security flaw was found in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with access to a virtual machine's management container could trick the system into overwriting critical files on the underlying host server. This could lead to system instability or unauthorized changes to server configuration, although the attacker cannot fully control the content written to those files.

Technologies: kubevirt.io/kubevirt (Go), KubeVirt. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-13218 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13218 being exploited in the wild.
How severe is CVE-2026-13218?: Medium severity, with a CVSS score of 4.2, published 26 June 2026.
Which products and versions are affected?: kubevirt.io/kubevirt (Go) <= 1.10.0-rc.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.10.0-rc.0; KubeVirt unspecified.
Is there a fix for CVE-2026-13218?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13218 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-13218?: Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A symlink following vulnerability (CWE-61) exists in KubeVirt's virt-handler network cache handling. The 'WriteToCachedFile' function in 'pkg/network/cache/cache.go' uses 'os.WriteFile' and 'os.Chown' on paths rooted in the launcher container without symlink protection (O_NOFOLLOW). An attacker with access to the virt-launcher container can create a symbolic link at the cache file path. Because virt-handler operates in the host mount namespace, it will follow the symlink and overwrite an arbitrary host file with JSON-formatted network cache data and change the file's ownership to UID 107. This vulnerability specifically affects bridge/non-masquerade network interfaces.

Affected products

KubeVirt KubeVirt unspecified
Red Hat Red Hat OpenShift Virtualization 4 4

Identifiers

CVE-2026-13218
GHSA-q3jc-42cq-33fj
GO-2026-6914

Timeline

2026-06-25: disclosed: Vulnerability reported via Red Hat Bugzilla
2026-06-26: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.