CVE-2026-13622highCWE-22

CVE-2026-13622: fallo de gravedad alta en Red Hat Container Native Virtualization 4.12

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Container Native Virtualization

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.2%
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Red Hat · Red Hat Container Native Virtualization 4.12Red Hat · Red Hat Container Native Virtualization 4.13Red Hat · Red Hat Container Native Virtualization 4.14Red Hat · Red Hat Container Native Virtualization 4.15Red Hat · Red Hat Container Native Virtualization 4.16Red Hat · Red Hat Container Native Virtualization 4.17Red Hat · Red Hat Container Native Virtualization 4.18Red Hat · Red Hat Container Native Virtualization 4.19Red Hat · Red Hat Container Native Virtualization 4.20Red Hat · Red Hat Container Native Virtualization 4.21Red Hat · Red Hat Container Native Virtualization 4.22
CVEs relacionadas — Red Hat Container Native Virtualization 4.12

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-7374CRITICALKubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityEPSS 0.7%CVE-2026-17527HIGHVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc cloneEPSS 0.6%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.3%