{"id":"CVE-2026-13622","state":"PUBLISHED","title":"Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","publishedAt":"2026-08-12T20:46:15.766Z","updatedAt":"2026-09-21T16:31:52.204Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Container Native Virtualization 4.12","Red Hat Red Hat Container Native Virtualization 4.13","Red Hat Red Hat Container Native Virtualization 4.14","Red Hat Red Hat Container Native Virtualization 4.15","Red Hat Red Hat Container Native Virtualization 4.16","Red Hat Red Hat Container Native Virtualization 4.17","Red Hat Red Hat Container Native Virtualization 4.18","Red Hat Red Hat Container Native Virtualization 4.19","Red Hat Red Hat Container Native Virtualization 4.20","Red Hat Red Hat Container Native Virtualization 4.21","Red Hat Red Hat Container Native Virtualization 4.22"],"affected":[{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.12","packageName":"container-native-virtualization/virt-handler","defaultStatus":"affected","versions":[{"version":"1785837722","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.13","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786346596","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.14","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786309624","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.15","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786347656","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.16","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786030071","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.17","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786348529","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.18","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786130068","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.19","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786334215","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.20","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785831334","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.21","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785829701","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.22","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785140336","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.22::el9"]}],"references":["https://access.redhat.com/errata/RHEA-2026:53670","https://access.redhat.com/errata/RHSA-2026:51031","https://access.redhat.com/errata/RHSA-2026:53655","https://access.redhat.com/errata/RHSA-2026:53671","https://access.redhat.com/errata/RHSA-2026:53684","https://access.redhat.com/errata/RHSA-2026:53721","https://access.redhat.com/errata/RHSA-2026:53728","https://access.redhat.com/errata/RHSA-2026:53763","https://access.redhat.com/errata/RHSA-2026:53797","https://access.redhat.com/errata/RHSA-2026:53826","https://access.redhat.com/errata/RHSA-2026:53838","https://access.redhat.com/security/cve/CVE-2026-13622","https://bugzilla.redhat.com/show_bug.cgi?id=2494142"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13622.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13622","state":"PUBLISHED","datePublished":"2026-08-12T20:46:15.766Z","dateUpdated":"2026-09-21T16:31:52.204Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-06-29T09:41:40.974Z"},"containers":{"cna":{"title":"Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host","descriptions":[{"lang":"en","value":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.12","packageName":"container-native-virtualization/virt-handler","defaultStatus":"affected","versions":[{"version":"1785837722","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.13","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786346596","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.14","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786309624","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.15","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786347656","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.16","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786030071","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.17","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786348529","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.18","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786130068","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.19","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1786334215","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.20","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785831334","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.21","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785829701","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat Container Native Virtualization 4.22","packageName":"container-native-virtualization/virt-handler-rhel9","defaultStatus":"affected","versions":[{"version":"1785140336","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:container_native_virtualization:4.22::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHEA-2026:53670","name":"RHEA-2026:53670","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51031","name":"RHSA-2026:51031","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53655","name":"RHSA-2026:53655","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53671","name":"RHSA-2026:53671","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53684","name":"RHSA-2026:53684","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53721","name":"RHSA-2026:53721","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53728","name":"RHSA-2026:53728","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53763","name":"RHSA-2026:53763","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53797","name":"RHSA-2026:53797","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53826","name":"RHSA-2026:53826","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53838","name":"RHSA-2026:53838","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13622","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494142","name":"RHBZ#2494142","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-21T16:31:52.204Z"},"datePublic":"2026-08-12T00:00:00.000Z","x_redhatCweChain":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","workarounds":[{"lang":"en","value":"Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. \n\nAdditionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events."}],"timeline":[{"lang":"en","time":"2026-06-29T10:07:50.206Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-12T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Huzaifa Sidhpurwala (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T19:21:32.127174Z","id":"CVE-2026-13622","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-13T19:26:40.533Z"}}]}}}