Executive brief
KubeVirt is a tool used to run and manage virtual machines within Kubernetes clusters. A security flaw in its management component allows an authorized user with basic permissions to trick the system into connecting to sensitive host files. This could allow an attacker to take full control of the underlying server and potentially the entire cluster, leading to total data exposure or service disruption.
Technical details
A flaw was found in KubeVirt's virt-handler component due to improper symlink validation when connecting to virtual machine console sockets (CWE-59). An authenticated attacker with 'edit' permissions in a namespace can replace a console socket with a symlink pointing to the host's container runtime (CRI-O) socket. Because virt-handler runs with hostPID and elevated privileges, it follows this symlink, allowing the attacker to hijack the privileged connection. This enables access to any Unix socket on the host, leading to full node and cluster compromise. The issue is fixed in KubeVirt versions 1.8.3, 1.7.4, and 1.6.6.
Affected products
- KubeVirt KubeVirt >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6
- Red Hat OpenShift Virtualization 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21
Timeline
- 2026-04-29: other: Reported to Red Hat Bugzilla
- 2026-05-26: disclosed
- 2026-05-26: advisory
- 2026-06-30: other: GitHub Advisory updated