VDB

CVE-2026-13622

CVE-2026-13622 PUBLISHED CVSS 8.8 HIGH

Reported by redhat · Published August 12, 2026

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Risk Scores

CVSS 3.1
8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Container Native Virtualization 4.121785837722
Red HatRed Hat Container Native Virtualization 4.131786346596
Red HatRed Hat Container Native Virtualization 4.141786309624
Red HatRed Hat Container Native Virtualization 4.151786347656
Red HatRed Hat Container Native Virtualization 4.161786030071
Red HatRed Hat Container Native Virtualization 4.171786348529
Red HatRed Hat Container Native Virtualization 4.181786130068
Red HatRed Hat Container Native Virtualization 4.191786334215
Red HatRed Hat Container Native Virtualization 4.201785831334
Red HatRed Hat Container Native Virtualization 4.211785829701
Red HatRed Hat Container Native Virtualization 4.221785140336
Red HatRed Hat Container Native Virtualization 4.151786347656, 1786347656, 1786347656
Red HatRed Hat Container Native Virtualization 4.161786030071, 1786030071, 1786030071
Red HatRed Hat Container Native Virtualization 4.181786130068, 1786130068, 1786130068
Red HatRed Hat OpenShift Virtualization 4
Red HatRed Hat Container Native Virtualization 4.21785831334
Red HatRed Hat Container Native Virtualization 4.131786346596, 1786346596, 1786346596
Red HatRed Hat Container Native Virtualization 4.121785837722, 1785837722, 1785837722
Red HatRed Hat Container Native Virtualization 4.201785831334, 1785831334, 1785831334
Red HatRed Hat Container Native Virtualization 4.141786309624, 1786309624, 1786309624

…and 5 more

Timeline

  • Aug 12, 2026 CVE Published
  • Aug 13, 2026 Coalition ESS Score
  • Aug 20, 2026 Security Advisory
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›