Redhat Openshift Virtualization vulnerabilities

CVE-2023-44487 [HIGH] CWE-400 CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancell The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-48795 [MEDIUM] CWE-354 CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other pr The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgr

CVE-2020-14316 [CRITICAL] CVE-2020-14316: A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest th

CVE-2026-13325 [HIGH] CWE-306 CVE-2026-13325: A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt

CVE-2026-13318 [MEDIUM] CWE-918 CVE-2026-13318: A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. Whe A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or sec

CVE-2026-13201 [HIGH] CWE-61 CVE-2026-13201: A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function us A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protec

CVE-2020-1742 [HIGH] CWE-266 CVE-2020-1742: An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.

CVE-2026-13434 [MEDIUM] CWE-20 CVE-2026-13434: A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineI A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or sanitization. The only admission check rejects empty string

CVE-2026-13208 [MEDIUM] CWE-287 CVE-2026-13208: A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomain A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from

CVE-2026-13218 [MEDIUM] CWE-61 CVE-2026-13218: A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function w A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary

CVE-2026-13322 [LOW] CWE-770 CVE-2026-13322: A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest request A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a