CVE-2026-13622highCWE-22

CVE-2026-13622: falha de alta gravidade em Red Hat Container Native Virtualization 4.12

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Container Native Virtualization

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.2%
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat Container Native Virtualization 4.12Red Hat · Red Hat Container Native Virtualization 4.13Red Hat · Red Hat Container Native Virtualization 4.14Red Hat · Red Hat Container Native Virtualization 4.15Red Hat · Red Hat Container Native Virtualization 4.16Red Hat · Red Hat Container Native Virtualization 4.17Red Hat · Red Hat Container Native Virtualization 4.18Red Hat · Red Hat Container Native Virtualization 4.19Red Hat · Red Hat Container Native Virtualization 4.20Red Hat · Red Hat Container Native Virtualization 4.21Red Hat · Red Hat Container Native Virtualization 4.22
CVEs relacionadas — Red Hat Container Native Virtualization 4.12

No mesmo produto, das mais perigosas para as menos.

CVE-2026-7374CRITICALKubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityEPSS 0.7%CVE-2026-17527HIGHVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc cloneEPSS 0.6%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.3%