Skip to content
Fencer Vulns
critical 9.9

CVE-2026-7374 json

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

published 2026-05-26 5 mo ago modified 2026-09-10 59 d ago also GHSA-7jcp-v9w4-wjmg , GO-2026-5848 , EUVD-2026-31824

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Patch / fix

  • go kubevirt.io/kubevirt 1.6.6, 1.7.4, 1.8.3
  • Red Hat Red Hat Container Native Virtualization 4.12 1779375376
  • Red Hat Red Hat Container Native Virtualization 4.13 1778999881
  • Red Hat Red Hat Container Native Virtualization 4.14 1779321599
  • Red Hat Red Hat Container Native Virtualization 4.15 1778859977
  • Red Hat Red Hat Container Native Virtualization 4.16 1778861274
  • Red Hat Red Hat Container Native Virtualization 4.17 1779174925
  • Red Hat Red Hat Container Native Virtualization 4.18 1778887155
  • Red Hat Red Hat Container Native Virtualization 4.19 1779289071
  • Red Hat Red Hat Container Native Virtualization 4.20 1779288737
  • Red Hat Red Hat Container Native Virtualization 4.21 1779420069
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.7.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.24.2

suse advisories SUSE-SU-2026:2401-1SUSE-SU-2026:2400-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

  • kubevirt Azure Linux 3.0 1.7.1-7

azure linux advisories AZL-89193

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-7374 updated cvss 9.9

kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

  • Red Hat Container Native Virtualization 4.12 container-native-virtualization 1779375376
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20825
  • Red Hat Container Native Virtualization 4.13 container-native-virtualization 1778999881
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20886
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization 1779321599
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20890
  • Red Hat Container Native Virtualization 4.15 container-native-virtualization 1778859977
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20866
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-handler-rhel9 1778861274
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20975
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization 1779174925
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20763
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization 1778887155
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20736
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization 1779289071
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20767
show 3 more
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization 1779288737
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20782
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization 1779420069
    fixed: vendor fix “Update cluster RBAC to not allow exec into virt-launcher pods.” RHSA-2026:20720
  • Red Hat Container Native Virtualization 4.12 container-native-virtualization 1779375359, container-native-virtualization 1779375363, container-native-virtualization 1779375371, container-native-virtualization 1779375374, container-native-virtualization 1779375384, container-native-virtualization 1779375385, +2 more Red Hat Container Native Virtualization 4.13 container-native-virtualization 1778999879, container-native-virtualization 1778999880, container-native-virtualization 1778999883, container-native-virtualization 1778999979, container-native-virtualization 1778999982 Red Hat Container Native Virtualization 4.14 container-native-virtualization 1779321406, container-native-virtualization 1779321446, container-native-virtualization 1779321472, container-native-virtualization 1779321475, container-native-virtualization 1779321531, container-native-virtualization 1779321546, +3 more Red Hat Container Native Virtualization 4.15 container-native-virtualization 1778859756, container-native-virtualization 1778859885, container-native-virtualization 1778859907, container-native-virtualization 1778859908, container-native-virtualization 1778859938, container-native-virtualization 1778859955, +3 more Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-api-rhel9 1778999683, container-native-virtualization/pr-helper-rhel9 1778861243, container-native-virtualization/sidecar-shim-rhel9 1778861270, container-native-virtualization/virt-launcher-rhel9 1778861279, container-native-virtualization/virt-operator-rhel9 1778861265, container-native-virtualization/virt-controller-rhel9 1778999678, +6 more Red Hat Container Native Virtualization 4.17 container-native-virtualization 1779174903, container-native-virtualization 1779174914, container-native-virtualization 1779174915, container-native-virtualization 1779174926, container-native-virtualization 1779174927, container-native-virtualization 1779174928, +6 more
    +4 more products
    Red Hat Container Native Virtualization 4.18 container-native-virtualization 1778887072, container-native-virtualization 1778887104, container-native-virtualization 1778887105, container-native-virtualization 1778887108, container-native-virtualization 1778887110, container-native-virtualization 1778887112, +6 more Red Hat Container Native Virtualization 4.19 container-native-virtualization 1779289070, container-native-virtualization 1779289073, container-native-virtualization 1779289092, container-native-virtualization 1779289111, container-native-virtualization 1779289195, container-native-virtualization 1779289280, +6 more Red Hat Container Native Virtualization 4.20 container-native-virtualization 1779288654, container-native-virtualization 1779288655, container-native-virtualization 1779288665, container-native-virtualization 1779288687, container-native-virtualization 1779288690, container-native-virtualization 1779288763, +7 more Red Hat Container Native Virtualization 4.21 container-native-virtualization 1779420025, container-native-virtualization 1779420028, container-native-virtualization 1779420029, container-native-virtualization 1779420037, container-native-virtualization 1779420043, container-native-virtualization 1779420045, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADP 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go kubevirt.io/kubevirt
>=1.8.0-alpha.0, <1.8.3
>=1.7.0-alpha.0, <1.7.4
<1.6.6
1.8.3
1.7.4
1.6.6

Affected products

  • Red Hat Red Hat Container Native Virtualization 4.12
  • Red Hat Red Hat Container Native Virtualization 4.13
  • Red Hat Red Hat Container Native Virtualization 4.14
  • Red Hat Red Hat Container Native Virtualization 4.15
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.