Riskcovery

CVE-2026-7374

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

State
Published
Severity
9.9 Critical
Published
May 26, 2026
Updated
Sep 10, 2026
Reserved
Apr 29, 2026

Read the record on cve.org

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hredhat
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

ProductVersions
kubevirt
  • before 1.6.6Affected
  • 1.7.0 to before 1.7.4Affected
  • 1.8.0 to before 1.8.3Affected
Red Hat Container Native Virtualization 4.12Red Hat
  • 1779375376 and laterNot affected
Red Hat Container Native Virtualization 4.13Red Hat
  • 1778999881 and laterNot affected
Red Hat Container Native Virtualization 4.14Red Hat
  • 1779321599 and laterNot affected
Red Hat Container Native Virtualization 4.15Red Hat
  • 1778859977 and laterNot affected
Red Hat Container Native Virtualization 4.16Red Hat
  • 1778861274 and laterNot affected
Red Hat Container Native Virtualization 4.17Red Hat
  • 1779174925 and laterNot affected
Red Hat Container Native Virtualization 4.18Red Hat
  • 1778887155 and laterNot affected
Red Hat Container Native Virtualization 4.19Red Hat
  • 1779289071 and laterNot affected
Red Hat Container Native Virtualization 4.20Red Hat
  • 1779288737 and laterNot affected
Red Hat Container Native Virtualization 4.21Red Hat
  • 1779420069 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.