# CVE-2026-13318: KubeVirt SSRF in virt-api port-forward handler

Source: https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-13318 · Severity: medium · CVSS 6.4 · Published 2026-06-26

A security vulnerability exists in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with permissions to manage virtual machines can trick the system into connecting to unauthorized internal network locations. This could allow an attacker to bypass network security rules and access sensitive internal services or data that should otherwise be isolated.

Technologies: [kubevirt.io/kubevirt (Go)](https://junglewise.ai/threats/technologies/kubevirt-io-kubevirt), [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-13318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13318 being exploited in the wild.

**How severe is CVE-2026-13318?** Medium severity, with a CVSS score of 6.4, published 26 June 2026.

**Which products and versions are affected?** kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.10.0-rc.0; KubeVirt unspecified.

**Is there a fix for CVE-2026-13318?** Yes. kubevirt.io/kubevirt (Go): upgrade to 1.10.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13318 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13318?** Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kubevirt.io/kubevirt (Go): upgrade to 1.10.0-rc.0 or later

  ```sh
  go get kubevirt.io/kubevirt@v1.10.0-rc.0
  ```


## Technical details

A server-side request forgery (SSRF) vulnerability exists in the KubeVirt virt-api port-forward handler. The 'getTargetInterfaceIP' function in 'pkg/virt-api/rest/dialers.go' retrieves the target IP address from 'vmi.Status.Interfaces[0].IP' and passes it to 'net.Dial()' without validation. For VirtualMachineInstances (VMIs) using bridge or secondary-only network bindings, this IP is supplied by the QEMU guest agent, which is controllable by the VM owner. An attacker with 'kubevirt.io:edit' permissions can deploy a VM with a malicious guest agent that reports an arbitrary IP address. By then initiating a port-forward request, the attacker can establish a bidirectional TCP tunnel from the virt-api's network context to any routable destination, effectively bypassing Kubernetes NetworkPolicies. The default masquerade binding is not affected as it uses cluster-assigned pod IPs.

## Affected products

- KubeVirt KubeVirt unspecified
- Red Hat Red Hat OpenShift Virtualization 4 4

## Identifiers

- CVE-2026-13318
- GHSA-cgm6-wvp9-4g5h

## Timeline

- 2026-06-25: disclosed: Vulnerability reported by Red Hat
- 2026-06-26: advisory: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-13318](https://access.redhat.com/security/cve/CVE-2026-13318)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2492659](https://bugzilla.redhat.com/show_bug.cgi?id=2492659)

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt authentication bypass in migration proxy when TLS is disabled](https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)
- [KubeVirt virt-handler improper authentication in domain notify server](https://junglewise.ai/threats/cve-2026-13208-kubevirt-virt-handler-improper-authentication-in-domain-notify)