{"id":"CVE-2026-13218","aliases":["GHSA-q3jc-42cq-33fj"],"title":"KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite","summary":"KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","vendor":"kubevirt","product":"kubevirt.io/kubevirt","ecosystem":"go","affected":["kubevirt.io/kubevirt <= 1.10.0-rc.0"],"published":"2026-06-26","updated":"2026-11-04","sourceUpdated":"2026-11-04T17:30:04.830667371Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q3jc-42cq-33fj","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13218"},{"url":"https://access.redhat.com/security/cve/CVE-2026-13218"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492654"},{"url":"https://github.com/kubevirt/kubevirt"},{"url":"https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103"},{"url":"https://github.com/advisories/GHSA-q3jc-42cq-33fj"}],"tags":["osv","go","ghsa"],"epss":0.00139,"epssPercentile":0.03286,"cwe":["CWE-61"],"ingestedAt":"2026-11-04T18:21:08.586Z","slug":"CVE-2026-13218","body":"## Overview\n\nA flaw was found in KubeVirt's virt-handler network cache handling. The writeToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.\n\n## Affected packages\n\n- `kubevirt.io/kubevirt <= 1.10.0-rc.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}