Vulnerability · Published Jun 25, 2026 · Assigned by redhat

CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

Medium 4.2

In plain English

A medium-severity security flaw in Red Hat OpenShift Virtualization 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.1%top 96.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	kubevirt.io/kubevirt	no fix listed	GHSA-q3jc-42cq-33fj
Go	kubevirt.io/kubevirt	no fix listed	GO-2026-6914

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Virtualization 4	see references
Red Hat	Red Hat OpenShift Virtualization 4	see references

Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

References

https://access.redhat.com/security/cve/CVE-2026-13218 vdb-entry, x_refsource_REDHAT
RHBZ#2492654 issue-tracking, x_refsource_REDHAT