CVE-2026-13622highCWE-22

CVE-2026-13622: high-severity vulnerability in Red Hat Container Native Virtualization 4.12

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Published · Updated

Follow this CVE+ Monitor Red Hat Container Native Virtualization

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.2%
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Red Hat · Red Hat Container Native Virtualization 4.12Red Hat · Red Hat Container Native Virtualization 4.13Red Hat · Red Hat Container Native Virtualization 4.14Red Hat · Red Hat Container Native Virtualization 4.15Red Hat · Red Hat Container Native Virtualization 4.16Red Hat · Red Hat Container Native Virtualization 4.17Red Hat · Red Hat Container Native Virtualization 4.18Red Hat · Red Hat Container Native Virtualization 4.19Red Hat · Red Hat Container Native Virtualization 4.20Red Hat · Red Hat Container Native Virtualization 4.21Red Hat · Red Hat Container Native Virtualization 4.22
Related CVEs — Red Hat Container Native Virtualization 4.12

In the same product, most dangerous first.

CVE-2026-7374CRITICALKubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityEPSS 0.7%CVE-2026-17527HIGHVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc cloneEPSS 0.6%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.3%