Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by redhat

CVE-2026-13622Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

High 8.8

In plain English

A high-severity path traversal in Red Hat Container Native Virtualization 4.12 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Container Native Virtualization 4.12 see references
Red Hat Red Hat Container Native Virtualization 4.13 see references
Red Hat Red Hat Container Native Virtualization 4.14 see references
Red Hat Red Hat Container Native Virtualization 4.15 see references
Red Hat Red Hat Container Native Virtualization 4.16 see references
Red Hat Red Hat Container Native Virtualization 4.17 see references
Red Hat Red Hat Container Native Virtualization 4.18 see references
Red Hat Red Hat Container Native Virtualization 4.19 see references
Red Hat Red Hat Container Native Virtualization 4.20 see references
Red Hat Red Hat Container Native Virtualization 4.21 see references
Red Hat Red Hat Container Native Virtualization 4.22 see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References