Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-7374

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

kubevirt

  • 0 to < 1.6.6affected
  • 1.7.0 to < 1.7.4affected
  • 1.8.0 to < 1.8.3affected

Red Hat Red Hat Container Native Virtualization 4.12

Default version status: affected

  • 1779375376 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.13

Default version status: affected

  • 1778999881 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.14

Default version status: affected

  • 1779321599 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.15

Default version status: affected

  • 1778859977 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.16

Default version status: affected

  • 1778861274 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.17

Default version status: affected

  • 1779174925 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.18

Default version status: affected

  • 1778887155 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.19

Default version status: affected

  • 1779289071 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.20

Default version status: affected

  • 1779288737 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.21

Default version status: affected

  • 1779420069 to < *unaffected

References