# CVE-2026-6383: KubeVirt incorrect RBAC evaluation via subresource name truncation

Source: https://junglewise.ai/threats/cve-2026-6383-kubevirt-incorrect-rbac-evaluation-via-subresource-name-truncation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6383 · Severity: medium · CVSS 5.4 · Published 2026-04-15

KubeVirt is a technology that allows Kubernetes to manage virtual machines alongside containers. A flaw in its security logic means that when checking if a user has permission to perform specific advanced actions (like taking a screenshot of a virtual machine), the system may incorrectly check permissions for a broader category instead. This could allow an authorized user to perform actions or view data they should not have access to, or conversely, prevent legitimate users from doing their jobs.

Technologies: [kubevirt.io/kubevirt (Go)](https://junglewise.ai/threats/technologies/kubevirt-io-kubevirt), [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-6383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6383 being exploited in the wild.

**How severe is CVE-2026-6383?** Medium severity, with a CVSS score of 5.4, published 15 April 2026.

**Which products and versions are affected?** kubevirt.io/kubevirt (Go) <= 1.8.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.8.1; KubeVirt <= 1.8.1.

**Is there a fix for CVE-2026-6383?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6383 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6383?** Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in KubeVirt's RBAC evaluation logic within the `virt-api` component. The `addNamespacedResourceAttributes` function in `pkg/virt-api/rest/authorizer.go` parses request paths using fixed indexes, which causes deep subresource names (e.g., 'vnc/screenshot') to be truncated to their first segment (e.g., 'vnc') when constructing a SubjectAccessReview (SAR). This mismatch between the actual requested subresource and the SAR sent to the Kubernetes API server results in incorrect permission checks. An authenticated attacker with low privileges could exploit this to access sensitive subresources they are not authorized for, or legitimate users may face unexpected access denials. As of the advisory date, no patched version is specified, though the issue affects versions up to and including 1.8.1.

## Affected products

- KubeVirt KubeVirt <= 1.8.1

## Identifiers

- CVE-2026-6383
- GHSA-j6cv-3w8p-vrg8
- GO-2026-5450

## Timeline

- 2026-03-30: other: Issue first reported on GitHub
- 2026-04-15: advisory: GitHub Advisory and NVD entry published
- 2026-04-15: disclosed: Red Hat Bugzilla entry created

## References

- [https://access.redhat.com/security/cve/CVE-2026-6383](https://access.redhat.com/security/cve/CVE-2026-6383)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2458741](https://bugzilla.redhat.com/show_bug.cgi?id=2458741)
- [https://github.com/kubevirt/kubevirt/issues/17337](https://github.com/kubevirt/kubevirt/issues/17337)

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt authentication bypass in migration proxy when TLS is disabled](https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt SSRF in virt-api port-forward handler](https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)