Executive brief
A security flaw in KubeVirt, a tool for running virtual machines on Kubernetes, allows unauthorized access to virtual machines when encryption is disabled. If a cluster administrator turns off migration encryption, the system inadvertently removes all authentication, allowing any user with a pod on the network to take control of other users' virtual machines. This could lead to attackers reading sensitive VM memory, modifying configurations, or deleting virtual machines entirely.
Technical details
A vulnerability exists in KubeVirt's migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go) when the 'disableTLS' setting is enabled. In this configuration, the virt-handler binds a plain TCP listener to all interfaces (0.0.0.0) on a random port without requiring authentication, peer allow-listing, or handshake tokens. This listener proxies directly to the target virt-launcher's virtqemud control socket. An attacker with pod-level network access can issue unfiltered libvirt RPC commands to interact with other tenants' VMs, enabling memory exfiltration, state modification via QMP, or VM destruction. The issue persists even if a dedicated migration network is configured, as the listener bind address remains global.
Affected products
- KubeVirt KubeVirt All versions where disableTLS is supported
- Red Hat OpenShift Virtualization 4 4
Timeline
- 2026-06-26: disclosed: Vulnerability published to NVD and Red Hat Bugzilla
- 2026-06-26: advisory