Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability
Priority MEDIUM 44CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00742 54th percentileScored 2026-11-07
Fix Fixed kubevirt: 1.6.6, 1.7.4, 1.8.3kubevirt.io/kubevirt (Go): 1.8.3, 1.7.4, 1.6.6Red Hat: 10 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | kubevirt | before 1.6.6; 1.7.0 to before 1.7.4; 1.8.0 to before 1.8.3 | 1.6.6, 1.7.4, 1.8.3 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.12 | — | 1779375376 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.13 | — | 1778999881 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.14 | — | 1779321599 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.15 | — | 1778859977 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.16 | — | 1778861274 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.17 | — | 1779174925 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — | 1778887155 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — | 1779289071 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — | 1779288737 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — | 1779420069 | Patch available | CNA |
| — | kubevirt.io/kubevirt (Go) | 1.8.0-alpha.0 to before 1.8.3 | 1.8.3 | Patch available | GHSA-7jcp-v9w4-wjmg |
| — | kubevirt.io/kubevirt (Go) | 1.7.0-alpha.0 to before 1.7.4 | 1.7.4 | Patch available | GHSA-7jcp-v9w4-wjmg |
| — | kubevirt.io/kubevirt (Go) | before 1.6.6 | 1.6.6 | Patch available | GHSA-7jcp-v9w4-wjmg |
- kubevirt Vendor— Affected before 1.6.6; 1.7.0 to before 1.7.4; 1.8.0 to before 1.8.3 Fixed in 1.6.6, 1.7.4, 1.8.3 Patch available CNA
- Red Hat Container Native Virtualization 4.12 VendorRed Hat Affected — Fixed in 1779375376 Patch available CNA
- Red Hat Container Native Virtualization 4.13 VendorRed Hat Affected — Fixed in 1778999881 Patch available CNA
- Red Hat Container Native Virtualization 4.14 VendorRed Hat Affected — Fixed in 1779321599 Patch available CNA
- Red Hat Container Native Virtualization 4.15 VendorRed Hat Affected — Fixed in 1778859977 Patch available CNA
- Red Hat Container Native Virtualization 4.16 VendorRed Hat Affected — Fixed in 1778861274 Patch available CNA
- Red Hat Container Native Virtualization 4.17 VendorRed Hat Affected — Fixed in 1779174925 Patch available CNA
- Red Hat Container Native Virtualization 4.18 VendorRed Hat Affected — Fixed in 1778887155 Patch available CNA
- Red Hat Container Native Virtualization 4.19 VendorRed Hat Affected — Fixed in 1779289071 Patch available CNA
- Red Hat Container Native Virtualization 4.20 VendorRed Hat Affected — Fixed in 1779288737 Patch available CNA
- Red Hat Container Native Virtualization 4.21 VendorRed Hat Affected — Fixed in 1779420069 Patch available CNA
- kubevirt.io/kubevirt (Go) Vendor— Affected 1.8.0-alpha.0 to before 1.8.3 Fixed in 1.8.3 Patch available GHSA-7jcp-v9w4-wjmg
- kubevirt.io/kubevirt (Go) Vendor— Affected 1.7.0-alpha.0 to before 1.7.4 Fixed in 1.7.4 Patch available GHSA-7jcp-v9w4-wjmg
- kubevirt.io/kubevirt (Go) Vendor— Affected before 1.6.6 Fixed in 1.6.6 Patch available GHSA-7jcp-v9w4-wjmg
CPE names CNA · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:container_native_virtualization:4.12::el8 | 4.12 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.17::el9 | 4.17 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.21::el9 | 4.21 | — | Red Hat |
- cpe:/a:redhat:container_native_virtualization:4.12::el8 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.17::el9 Versions 4.17 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.21::el9 Versions 4.21 — ·Red Hat
Remediation
- Fix · CNA kubevirt Fixed in 1.6.6, 1.7.4, 1.8.3
- Fix · GHSA-7jcp-v9w4-wjmg kubevirt.io/kubevirt (Go) Fixed in 1.8.3 Advisory →
- Fix · GHSA-7jcp-v9w4-wjmg kubevirt.io/kubevirt (Go) Fixed in 1.7.4 Advisory →
- Fix · GHSA-7jcp-v9w4-wjmg kubevirt.io/kubevirt (Go) Fixed in 1.6.6 Advisory →
Red Hat 10 advisories
- RHSA-2026:20975 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.16 Images
- Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20890 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.14 Images
- Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20886 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.13 Images
- Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
Show 7 more Red Hat advisories
- RHSA-2026:20866 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.15 Images
- Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20825 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.12 Images
- Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/virt-handler
- RHSA-2026:20782 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.20 Images
- Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20767 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.19 Images
- Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20763 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.17 Images
- Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20736 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.18 Images
- Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
- RHSA-2026:20720 Released 2026-05-26 · Red Hat rating ImportantOpenShift Virtualization v4.21 Images
- Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Container Native Virtualization 4.12 | Fixed | RHSA-2026:20825 |
| Red Hat Container Native Virtualization 4.13 | Fixed | RHSA-2026:20886 |
| Red Hat Container Native Virtualization 4.14 | Fixed | RHSA-2026:20890 |
| Red Hat Container Native Virtualization 4.15 | Fixed | RHSA-2026:20866 |
| Red Hat Container Native Virtualization 4.16 | Fixed | RHSA-2026:20975 |
| Red Hat Container Native Virtualization 4.17 | Fixed | RHSA-2026:20763 |
| Red Hat Container Native Virtualization 4.18 | Fixed | RHSA-2026:20736 |
| Red Hat Container Native Virtualization 4.19 | Fixed | RHSA-2026:20767 |
| Red Hat Container Native Virtualization 4.20 | Fixed | RHSA-2026:20782 |
| Red Hat Container Native Virtualization 4.21 | Fixed | RHSA-2026:20720 |
Not affected: 10 products
- Red Hat Container Native Virtualization 4.12
- Red Hat Container Native Virtualization 4.13
- Red Hat Container Native Virtualization 4.14
- Red Hat Container Native Virtualization 4.15
- Red Hat Container Native Virtualization 4.16
- Red Hat Container Native Virtualization 4.17
- Red Hat Container Native Virtualization 4.18
- Red Hat Container Native Virtualization 4.19
- Red Hat Container Native Virtualization 4.20
- Red Hat Container Native Virtualization 4.21
Timeline
- 2026-10-02 Threatist record created from CVE-2026-7374
- 2026-10-03 Alias added: GHSA-7jcp-v9w4-wjmg
References
Advisory 11
Other 6
- https://access.redhat.com/security/cve/CVE-2026-7374
- RHBZ#2463728
- https://github.com/kubevirt/kubevirt/pull/17916
- https://github.com/kubevirt/kubevirt/commit/011eef8129e2c21e0ea496f283ee1676009bc757
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json
- https://github.com/kubevirt/kubevirt
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-7374 · CVE Program
- CVE-2026-7374 · NVD
- FIRST EPSS
- GHSA-7jcp-v9w4-wjmg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-7374 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences