Executive brief
KubeVirt is a technology that allows Kubernetes to manage virtual machines alongside containers. A flaw in its security logic means that when checking if a user has permission to perform specific advanced actions (like taking a screenshot of a virtual machine), the system may incorrectly check permissions for a broader category instead. This could allow an authorized user to perform actions or view data they should not have access to, or conversely, prevent legitimate users from doing their jobs.
Technical details
A vulnerability exists in KubeVirt's RBAC evaluation logic within the `virt-api` component. The `addNamespacedResourceAttributes` function in `pkg/virt-api/rest/authorizer.go` parses request paths using fixed indexes, which causes deep subresource names (e.g., 'vnc/screenshot') to be truncated to their first segment (e.g., 'vnc') when constructing a SubjectAccessReview (SAR). This mismatch between the actual requested subresource and the SAR sent to the Kubernetes API server results in incorrect permission checks. An authenticated attacker with low privileges could exploit this to access sensitive subresources they are not authorized for, or legitimate users may face unexpected access denials. As of the advisory date, no patched version is specified, though the issue affects versions up to and including 1.8.1.
Affected products
- KubeVirt KubeVirt <= 1.8.1
Timeline
- 2026-03-30: other: Issue first reported on GitHub
- 2026-04-15: advisory: GitHub Advisory and NVD entry published
- 2026-04-15: disclosed: Red Hat Bugzilla entry created