Read the docs
TI-2026-11533 Aliases CVE-2026-13622GHSA-4336-pf6g-hp94

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed Red Hat: 10 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Container Native Virtualization 4.12—1785837722Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.13—1786346596Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.14—1786309624Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.15—1786347656Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.16—1786030071Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.17—1786348529Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.18—1786130068Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.19—1786334215Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.20—1785831334Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.21—1785829701Patch availableCNA
Red HatRed Hat Container Native Virtualization 4.22—1785140336Patch availableCNA
  • Red Hat Container Native Virtualization 4.12 VendorRed Hat Affected — Fixed in 1785837722 Patch available CNA
  • Red Hat Container Native Virtualization 4.13 VendorRed Hat Affected — Fixed in 1786346596 Patch available CNA
  • Red Hat Container Native Virtualization 4.14 VendorRed Hat Affected — Fixed in 1786309624 Patch available CNA
  • Red Hat Container Native Virtualization 4.15 VendorRed Hat Affected — Fixed in 1786347656 Patch available CNA
  • Red Hat Container Native Virtualization 4.16 VendorRed Hat Affected — Fixed in 1786030071 Patch available CNA
  • Red Hat Container Native Virtualization 4.17 VendorRed Hat Affected — Fixed in 1786348529 Patch available CNA
  • Red Hat Container Native Virtualization 4.18 VendorRed Hat Affected — Fixed in 1786130068 Patch available CNA
  • Red Hat Container Native Virtualization 4.19 VendorRed Hat Affected — Fixed in 1786334215 Patch available CNA
  • Red Hat Container Native Virtualization 4.20 VendorRed Hat Affected — Fixed in 1785831334 Patch available CNA
  • Red Hat Container Native Virtualization 4.21 VendorRed Hat Affected — Fixed in 1785829701 Patch available CNA
  • Red Hat Container Native Virtualization 4.22 VendorRed Hat Affected — Fixed in 1785140336 Patch available CNA

CPE names CNA · 11

CPEVersionsRoleVendor
cpe:/a:redhat:container_native_virtualization:4.12::el84.12—Red Hat
cpe:/a:redhat:container_native_virtualization:4.13::el94.13—Red Hat
cpe:/a:redhat:container_native_virtualization:4.14::el94.14—Red Hat
cpe:/a:redhat:container_native_virtualization:4.15::el94.15—Red Hat
cpe:/a:redhat:container_native_virtualization:4.16::el94.16—Red Hat
cpe:/a:redhat:container_native_virtualization:4.17::el94.17—Red Hat
cpe:/a:redhat:container_native_virtualization:4.18::el94.18—Red Hat
cpe:/a:redhat:container_native_virtualization:4.19::el94.19—Red Hat
cpe:/a:redhat:container_native_virtualization:4.20::el94.20—Red Hat
cpe:/a:redhat:container_native_virtualization:4.21::el94.21—Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.12::el8 Versions 4.12 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.13::el9 Versions 4.13 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.14::el9 Versions 4.14 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.15::el9 Versions 4.15 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.16::el9 Versions 4.16 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.17::el9 Versions 4.17 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.18::el9 Versions 4.18 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.19::el9 Versions 4.19 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.20::el9 Versions 4.20 — ·Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.21::el9 Versions 4.21 — ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:container_native_virtualization:4.22::el94.22—Red Hat
  • cpe:/a:redhat:container_native_virtualization:4.22::el9 Versions 4.22 — ·Red Hat

Remediation

Red Hat 10 advisories

  • RHSA-2026:53838 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.18 Images
    • Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53826 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53797 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
Show 7 more Red Hat advisories
  • RHSA-2026:53763 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/virt-api-rhel9, registry.redhat.io/container-native-virtualization/virt-handler-rhel9, registry.redhat.io/container-native-virtualization/virt-operator-rhel9
  • RHSA-2026:53728 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/virt-handler-rhel9, registry.redhat.io/container-native-virtualization/virt-operator-rhel9
  • RHSA-2026:53721 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53684 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53671 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:53655 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9, registry.redhat.io/container-native-virtualization/virt-handler-rhel9
  • RHSA-2026:51031 Released 2026-08-06 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/virt-handler-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Container Native Virtualization 4.12Fixed—
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53655
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:53671
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:53826
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:53721
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:53684
Red Hat Container Native Virtualization 4.18Fixed RHSA-2026:53838
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:53797
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:53763
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:53728
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:51031
Not affected: 11 products
  • Red Hat Container Native Virtualization 4.12
  • Red Hat Container Native Virtualization 4.13
  • Red Hat Container Native Virtualization 4.14
  • Red Hat Container Native Virtualization 4.15
  • Red Hat Container Native Virtualization 4.16
  • Red Hat Container Native Virtualization 4.17
  • Red Hat Container Native Virtualization 4.18
  • Red Hat Container Native Virtualization 4.19
  • Red Hat Container Native Virtualization 4.20
  • Red Hat Container Native Virtualization 4.21
  • Red Hat Container Native Virtualization 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13622
  2. 2026-10-03 Alias added: GHSA-4336-pf6g-hp94

References

Advisory 11

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences