Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-13622

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Container Native Virtualization 4.12

Default version status: affected

  • 1785837722 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.13

Default version status: affected

  • 1786346596 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.14

Default version status: affected

  • 1786309624 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.15

Default version status: affected

  • 1786347656 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.16

Default version status: affected

  • 1786030071 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.17

Default version status: affected

  • 1786348529 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.18

Default version status: affected

  • 1786130068 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.19

Default version status: affected

  • 1786334215 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.20

Default version status: affected

  • 1785831334 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.21

Default version status: affected

  • 1785829701 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.22

Default version status: affected

  • 1785140336 to < *unaffected

References