9.9

CVE-2026-7374

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.12
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.13
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.14
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.15
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.16
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.17
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.18
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.19
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.20
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.21
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.6% 0.44
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://access.redhat.com/security/cve/CVE-2026-7374
https://bugzilla.redhat.com/show_bug.cgi?id=2463728
https://access.redhat.com/errata/RHSA-2026:20720
https://access.redhat.com/errata/RHSA-2026:20736
https://access.redhat.com/errata/RHSA-2026:20763
https://access.redhat.com/errata/RHSA-2026:20782
https://access.redhat.com/errata/RHSA-2026:20825
https://access.redhat.com/errata/RHSA-2026:20866
https://access.redhat.com/errata/RHSA-2026:20886
https://access.redhat.com/errata/RHSA-2026:20890
https://access.redhat.com/errata/RHSA-2026:20975
https://access.redhat.com/errata/RHSA-2026:20767
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json