# CVE-2026-13325: KubeVirt authentication bypass in migration proxy when TLS is disabled

Source: https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-13325 · Severity: high · CVSS 8.5 · Published 2026-06-26

A security flaw in KubeVirt, a tool for running virtual machines on Kubernetes, allows unauthorized access to virtual machines when encryption is disabled. If a cluster administrator turns off migration encryption, the system inadvertently removes all authentication, allowing any user with a pod on the network to take control of other users' virtual machines. This could lead to attackers reading sensitive VM memory, modifying configurations, or deleting virtual machines entirely.

Technologies: [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-13325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13325 being exploited in the wild.

**How severe is CVE-2026-13325?** High severity, with a CVSS score of 8.5, published 26 June 2026.

**Which products and versions are affected?** KubeVirt All versions where disableTLS is supported.

**Is there a fix for CVE-2026-13325?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13325 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13325?** Check whether you run KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in KubeVirt's migration proxy (pkg/virt-handler/migration-proxy/migration-proxy.go) when the 'disableTLS' setting is enabled. In this configuration, the virt-handler binds a plain TCP listener to all interfaces (0.0.0.0) on a random port without requiring authentication, peer allow-listing, or handshake tokens. This listener proxies directly to the target virt-launcher's virtqemud control socket. An attacker with pod-level network access can issue unfiltered libvirt RPC commands to interact with other tenants' VMs, enabling memory exfiltration, state modification via QMP, or VM destruction. The issue persists even if a dedicated migration network is configured, as the listener bind address remains global.

## Affected products

- KubeVirt KubeVirt All versions where disableTLS is supported
- Red Hat OpenShift Virtualization 4 4

## Timeline

- 2026-06-26: disclosed: Vulnerability published to NVD and Red Hat Bugzilla
- 2026-06-26: advisory

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-13325](https://access.redhat.com/security/cve/CVE-2026-13325)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2493378](https://bugzilla.redhat.com/show_bug.cgi?id=2493378)

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt SSRF in virt-api port-forward handler](https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)
- [KubeVirt virt-handler improper authentication in domain notify server](https://junglewise.ai/threats/cve-2026-13208-kubevirt-virt-handler-improper-authentication-in-domain-notify)