Read the docs
TI-2026-11209 Aliases CVE-2026-13201GHSA-rcfc-7m3g-h5xh

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler…

Priority LOW 32CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix Fixed Red Hat: 11 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Container Native Virtualization 4.12—1791522624Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.13—1786346596Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.14—1786309624Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.15—1786347656Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.16—1786030071Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.17—1786348529Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.18—1786130068Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.19—1786334215Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.20—1785831334Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.21—1785829701Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.22—1785140336Patch availableCNA
  • Red Hat Container Native Virtualization 4.12 VendorRed Hat Affected — Fixed in 1791522624 Patch available CNA
  • Red Hat Container Native Virtualization 4.13 VendorRed Hat Affected — Fixed in 1786346596 Patch available CNA
  • Red Hat Container Native Virtualization 4.14 VendorRed Hat Affected — Fixed in 1786309624 Patch available CNA
  • Red Hat Container Native Virtualization 4.15 VendorRed Hat Affected — Fixed in 1786347656 Patch available CNA
  • Red Hat Container Native Virtualization 4.16 VendorRed Hat Affected — Fixed in 1786030071 Patch available CNA
  • Red Hat Container Native Virtualization 4.17 VendorRed Hat Affected — Fixed in 1786348529 Patch available CNA
  • Red Hat Container Native Virtualization 4.18 VendorRed Hat Affected — Fixed in 1786130068 Patch available CNA
  • Red Hat Container Native Virtualization 4.19 VendorRed Hat Affected — Fixed in 1786334215 Patch available CNA
  • Red Hat Container Native Virtualization 4.20 VendorRed Hat Affected — Fixed in 1785831334 Patch available CNA
  • Red Hat Container Native Virtualization 4.21 VendorRed Hat Affected — Fixed in 1785829701 Patch available CNA
  • Red Hat Container Native Virtualization 4.22 VendorRed Hat Affected — Fixed in 1785140336 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*not specified by NVDVulnerablekubevirt
cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*4 – 4.22.0VulnerableRed Hat
  • cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:* Versions not specified by NVD Vulnerable ·kubevirt
  • cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:* Versions 4 – 4.22.0 Vulnerable ·Red Hat

Remediation

Red Hat 11 advisories

  • RHSA-2026:80941 Released 2026-10-12 · Red Hat rating Moderate
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/virt-handler
  • RHSA-2026:53838 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.18 Images
    • Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53826 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
Show 8 more Red Hat advisories
  • RHSA-2026:53797 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53763 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/virt-api-rhel9, registry.redhat.io/container-native-virtualization/virt-handler-rhel9, registry.redhat.io/container-native-virtualization/virt-operator-rhel9
  • RHSA-2026:53728 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/virt-handler-rhel9, registry.redhat.io/container-native-virtualization/virt-operator-rhel9
  • RHSA-2026:53721 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53684 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53671 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53655 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9, registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:51031 Released 2026-08-06 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/virt-handler-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:80941
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53655
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:53671
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:53826
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:53721
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:53684
Red Hat Container Native Virtualization 4.18Fixed RHSA-2026:53838
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:53797
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:53763
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:53728
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:51031
Not affected: 11 products
  • Red Hat Container Native Virtualization 4.12
  • Red Hat Container Native Virtualization 4.13
  • Red Hat Container Native Virtualization 4.14
  • Red Hat Container Native Virtualization 4.15
  • Red Hat Container Native Virtualization 4.16
  • Red Hat Container Native Virtualization 4.17
  • Red Hat Container Native Virtualization 4.18
  • Red Hat Container Native Virtualization 4.19
  • Red Hat Container Native Virtualization 4.20
  • Red Hat Container Native Virtualization 4.21
  • Red Hat Container Native Virtualization 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13201
  2. 2026-10-03 Alias added: GHSA-rcfc-7m3g-h5xh
  3. 2026-10-12 Fix available: container-native-virtualization/virt-handler@1791522624 · CNA
  4. 2026-10-12 1 new reference · CNA
  5. 2026-10-13 Fix available: RHSA-2026:80941 · Red Hat
  6. 2026-10-13 Fix available: Red Hat Container Native Virtualization 4.12 · Red Hat

References

Advisory 13

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2020-11187 Improper privilege management in kubevirt CVSS 3.1CRITICAL 9.9
  • TI-2020-01686 Incorrect permission assignment in nmstate/kubernetes-nmstate-handler CVSS 3.1HIGH 7.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences