Skip to content
Threat Feed
Subscribe

Vendor

KubeVirt

3 briefs RSS
high advisory

KubeVirt virt-handler Privilege Escalation via Symlink Injection

A symlink following vulnerability (CVE-2026-13622) in KubeVirt allows an attacker with pod execution permissions to escalate privileges and achieve full node compromise by redirecting migration proxy socket traffic.

KubeVirt kubernetes cloud privilege-escalation container-security
1t 1c
high advisory

KubeVirt virt-exportserver Path Traversal Vulnerability (CVE-2026-9804)

A path traversal vulnerability exists in KubeVirt's virt-exportserver component, where an attacker with namespace-level access can exploit this flaw by creating a symbolic link within an exported filesystem PVC to read arbitrary files from the exporter pod, leading to information disclosure.

virt-exportserver kube-virt path-traversal vulnerability cloud
2r 1t 1c
critical advisory

KubeVirt virt-handler Symlink Vulnerability Leading to Container Escape (CVE-2026-7374)

CVE-2026-7374 allows an authenticated OpenShift user with edit permissions in a single namespace to escalate privileges to full cluster control by exploiting improper symlink validation in KubeVirt's virt-handler component when connecting to VM console sockets.

virt-handler +1 kubeVirt openshift symlink container escape privilege escalation
2r 1t 1c