CVE-2026-7374: KubeVirt virt-handler privilege escalation via symlink following

CVE-2026-7374 · Severity: critical · CVSS 9.9 · Published 2026-05-26

KubeVirt is a tool used to run and manage virtual machines within Kubernetes clusters. A security flaw in its management component allows an authorized user with basic permissions to trick the system into connecting to sensitive host files. This could allow an attacker to take full control of the underlying server and potentially the entire cluster, leading to total data exposure or service disruption.

Technologies: kubevirt.io/kubevirt (Go), KubeVirt. Vendors: Go, KubeVirt.

Quick answers

Is CVE-2026-7374 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7374 being exploited in the wild.
How severe is CVE-2026-7374?
Critical severity, with a CVSS score of 9.9, published 26 May 2026.
Which products and versions are affected?
kubevirt.io/kubevirt (Go) SEMVER:introduced=0,fixed=1.6.6,introduced=1.7.0-alpha.0,fixed=1.7.4,introduced=1.8.0-alpha.0,fixed=1.8.3, SEMVER:introduced=1.8.0-alpha.0,fixed=1.8.3; KubeVirt >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6, unspecified.
Is there a fix for CVE-2026-7374?
Yes. kubevirt.io/kubevirt (Go): upgrade to 1.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7374 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7374?
Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • kubevirt.io/kubevirt (Go): upgrade to 1.8.3 or later
    go get kubevirt.io/kubevirt@v1.8.3

Technical details

A flaw was found in KubeVirt's virt-handler component due to improper symlink validation when connecting to virtual machine console sockets (CWE-59). An authenticated attacker with 'edit' permissions in a namespace can replace a console socket with a symlink pointing to the host's container runtime (CRI-O) socket. Because virt-handler runs with hostPID and elevated privileges, it follows this symlink, allowing the attacker to hijack the privileged connection. This enables access to any Unix socket on the host, leading to full node and cluster compromise. The issue is fixed in KubeVirt versions 1.8.3, 1.7.4, and 1.6.6.

Affected products

  • KubeVirt KubeVirt >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6
  • Red Hat OpenShift Virtualization 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21

Identifiers

  • CVE-2026-7374
  • GHSA-7jcp-v9w4-wjmg
  • GO-2026-5848

Timeline

  • 2026-04-29: other: Reported to Red Hat Bugzilla
  • 2026-05-26: disclosed
  • 2026-05-26: advisory
  • 2026-06-30: other: GitHub Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.