Is CVE-2026-13325 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13325 being exploited in the wild.

How severe is CVE-2026-13325?

High severity, with a CVSS score of 8.5, published 26 June 2026.

Which products and versions are affected?

KubeVirt All versions where disableTLS is supported.

Is there a fix for CVE-2026-13325?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13325 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13325?

Check whether you run KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13325: KubeVirt authentication bypass in migration proxy when TLS is disabled

CVE-2026-13325 · Severity: high · CVSS 8.5 · Published 2026-06-26

A security flaw in KubeVirt, a tool for running virtual machines on Kubernetes, allows unauthorized access to virtual machines when encryption is disabled. If a cluster administrator turns off migration encryption, the system inadvertently removes all authentication, allowing any user with a pod on the network to take control of other users' virtual machines. This could lead to attackers reading sensitive VM memory, modifying configurations, or deleting virtual machines entirely.

Technologies: KubeVirt. Vendors: KubeVirt.

Quick answers

Is CVE-2026-13325 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13325 being exploited in the wild.
How severe is CVE-2026-13325?: High severity, with a CVSS score of 8.5, published 26 June 2026.
Which products and versions are affected?: KubeVirt All versions where disableTLS is supported.
Is there a fix for CVE-2026-13325?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13325 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13325?: Check whether you run KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in KubeVirt's migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go) when the 'disableTLS' setting is enabled. In this configuration, the virt-handler binds a plain TCP listener to all interfaces (0.0.0.0) on a random port without requiring authentication, peer allow-listing, or handshake tokens. This listener proxies directly to the target virt-launcher's virtqemud control socket. An attacker with pod-level network access can issue unfiltered libvirt RPC commands to interact with other tenants' VMs, enabling memory exfiltration, state modification via QMP, or VM destruction. The issue persists even if a dedicated migration network is configured, as the listener bind address remains global.

Affected products

KubeVirt KubeVirt All versions where disableTLS is supported
Red Hat OpenShift Virtualization 4 4

Timeline

2026-06-26: disclosed: Vulnerability published to NVD and Red Hat Bugzilla
2026-06-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.