Is CVE-2026-13318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13318 being exploited in the wild.

How severe is CVE-2026-13318?

Medium severity, with a CVSS score of 6.4, published 26 June 2026.

Which products and versions are affected?

kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.10.0-rc.0; KubeVirt unspecified.

Is there a fix for CVE-2026-13318?

Yes. kubevirt.io/kubevirt (Go): upgrade to 1.10.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13318 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13318?

Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13318: KubeVirt SSRF in virt-api port-forward handler

CVE-2026-13318 · Severity: medium · CVSS 6.4 · Published 2026-06-26

A security vulnerability exists in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with permissions to manage virtual machines can trick the system into connecting to unauthorized internal network locations. This could allow an attacker to bypass network security rules and access sensitive internal services or data that should otherwise be isolated.

Technologies: kubevirt.io/kubevirt (Go), KubeVirt. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-13318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13318 being exploited in the wild.
How severe is CVE-2026-13318?: Medium severity, with a CVSS score of 6.4, published 26 June 2026.
Which products and versions are affected?: kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.10.0-rc.0; KubeVirt unspecified.
Is there a fix for CVE-2026-13318?: Yes. kubevirt.io/kubevirt (Go): upgrade to 1.10.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13318 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13318?: Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kubevirt.io/kubevirt (Go): upgrade to 1.10.0-rc.0 or later
```
go get kubevirt.io/kubevirt@v1.10.0-rc.0
```

Technical details

A server-side request forgery (SSRF) vulnerability exists in the KubeVirt virt-api port-forward handler. The 'getTargetInterfaceIP' function in 'pkg/virt-api/rest/dialers.go' retrieves the target IP address from 'vmi.Status.Interfaces[0].IP' and passes it to 'net.Dial()' without validation. For VirtualMachineInstances (VMIs) using bridge or secondary-only network bindings, this IP is supplied by the QEMU guest agent, which is controllable by the VM owner. An attacker with 'kubevirt.io:edit' permissions can deploy a VM with a malicious guest agent that reports an arbitrary IP address. By then initiating a port-forward request, the attacker can establish a bidirectional TCP tunnel from the virt-api's network context to any routable destination, effectively bypassing Kubernetes NetworkPolicies. The default masquerade binding is not affected as it uses cluster-assigned pod IPs.

Affected products

KubeVirt KubeVirt unspecified
Red Hat Red Hat OpenShift Virtualization 4 4

Identifiers

CVE-2026-13318
GHSA-cgm6-wvp9-4g5h

Timeline

2026-06-25: disclosed: Vulnerability reported by Red Hat
2026-06-26: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.