Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by redhat

CVE-2026-13201Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

High 7.3

In plain English

A high-severity security flaw in Red Hat Container Native Virtualization 4.12 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 76.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Container Native Virtualization 4.12 see references
Red Hat Red Hat Container Native Virtualization 4.13 see references
Red Hat Red Hat Container Native Virtualization 4.14 see references
Red Hat Red Hat Container Native Virtualization 4.15 see references
Red Hat Red Hat Container Native Virtualization 4.16 see references
Red Hat Red Hat Container Native Virtualization 4.17 see references
Red Hat Red Hat Container Native Virtualization 4.18 see references
Red Hat Red Hat Container Native Virtualization 4.19 see references
Red Hat Red Hat Container Native Virtualization 4.20 see references
Red Hat Red Hat Container Native Virtualization 4.21 see references
Red Hat Red Hat Container Native Virtualization 4.22 see references

Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

References