9.9

CVE-2026-7374

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.12
Default Statusaffected
Version 1779375376
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.13
Default Statusaffected
Version 1778999881
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.14
Default Statusaffected
Version 1779321599
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.15
Default Statusaffected
Version 1778859977
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.16
Default Statusaffected
Version 1778861274
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.17
Default Statusaffected
Version 1779174925
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.18
Default Statusaffected
Version 1778887155
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.19
Default Statusaffected
Version 1779289071
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.20
Default Statusaffected
Version 1779288737
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Container Native Virtualization 4.21
Default Statusaffected
Version 1779420069
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.6% 0.44
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://bugzilla.redhat.com/show_bug.cgi?id=2463728
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json
https://access.redhat.com/errata/RHSA-2026:20720
https://access.redhat.com/errata/RHSA-2026:20736
https://access.redhat.com/errata/RHSA-2026:20763
https://access.redhat.com/errata/RHSA-2026:20767
https://access.redhat.com/errata/RHSA-2026:20782
https://access.redhat.com/errata/RHSA-2026:20825
https://access.redhat.com/errata/RHSA-2026:20866
https://access.redhat.com/errata/RHSA-2026:20886
https://access.redhat.com/errata/RHSA-2026:20890
https://access.redhat.com/errata/RHSA-2026:20975
https://access.redhat.com/security/cve/CVE-2026-7374