Is CVE-2026-13434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13434 being exploited in the wild.

How severe is CVE-2026-13434?

Medium severity, with a CVSS score of 4.9, published 26 June 2026.

Is there a fix for CVE-2026-13434?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13434 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13434?

Check whether you run KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13434: KubeVirt improper input validation in network annotation generator

CVE-2026-13434 · Severity: medium · CVSS 4.9 · Published 2026-06-26

A security flaw in KubeVirt's network configuration tool allows users with virtual machine creation permissions to bypass network isolation. By providing specially crafted network names, an attacker can connect their virtual machines to private networks belonging to other users or the system. This could lead to unauthorized access to sensitive data or the ability to impersonate other services on the network.

Technologies: KubeVirt. Vendors: KubeVirt.

Quick answers

Is CVE-2026-13434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13434 being exploited in the wild.
How severe is CVE-2026-13434?: Medium severity, with a CVSS score of 4.9, published 26 June 2026.
Which products and versions are affected?: KubeVirt v1.8.0+.
Is there a fix for CVE-2026-13434?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13434 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13434?: Check whether you run KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability exists in KubeVirt's network annotation generator. When a VirtualMachineInstance is created with a Multus network configuration, the 'networkName' value is written directly to the launcher pod's 'v1.multus-cni.io/default-network' annotation without sanitization. If the 'ExternalNetResourceInjection' feature gate is enabled, the system skips the NetworkAttachmentDefinition (NAD) lookup that would normally validate the name. An attacker with 'kubevirt.io:edit' permissions can inject a JSON-formatted array to specify arbitrary namespaces, NAD names, and static IP/MAC addresses, effectively attaching the pod to any network segment on the node.

Affected products

KubeVirt KubeVirt v1.8.0+
Red Hat OpenShift Virtualization 4.21+

Timeline

2026-06-26: disclosed: Initial vulnerability report and CVE assignment.
2026-06-26: advisory: Red Hat published security advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.