{"id":"CVE-2026-6383","state":"PUBLISHED","title":"Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation","description":"A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.","publishedAt":"2026-04-15T18:22:30.589Z","updatedAt":"2026-04-15T18:40:31.052Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift Virtualization 4"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","packageName":"kubevirt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:container_native_virtualization:4"]}],"references":["https://access.redhat.com/security/cve/CVE-2026-6383","https://bugzilla.redhat.com/show_bug.cgi?id=2458741"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6383.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6383","state":"PUBLISHED","datePublished":"2026-04-15T18:22:30.589Z","dateUpdated":"2026-04-15T18:40:31.052Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-04-15T18:03:12.839Z"},"containers":{"cna":{"title":"Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation","descriptions":[{"lang":"en","value":"A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","packageName":"kubevirt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:container_native_virtualization:4"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6383","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458741","name":"RHBZ#2458741","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-04-15T18:22:30.589Z"},"datePublic":"2026-04-15T18:03:18.572Z","x_redhatCweChain":"CWE-863: Incorrect Authorization","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-04-15T18:00:56.227Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-15T18:03:18.572Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-15T18:40:06.751506Z","id":"CVE-2026-6383","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-15T18:40:31.052Z"}}]}}}