Vulnerability · Published Apr 15, 2026 · Assigned by redhat

CVE-2026-6383Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

Medium 5.4

In plain English

A medium-severity incorrect authorization in Red Hat OpenShift Virtualization 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 95.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	kubevirt.io/kubevirt	no fix listed	GHSA-j6cv-3w8p-vrg8
Go	kubevirt.io/kubevirt	no fix listed	GO-2026-5450

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Virtualization 4	see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-6383 vdb-entry, x_refsource_REDHAT
RHBZ#2458741 issue-tracking, x_refsource_REDHAT