CVE-2026-13218Medium· 4.2▾ SunlitKubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.1%
A flaw was found in KubeVirt's virt-handler network cache handling. The writeToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.
kubevirt.io/kubevirt <= 1.10.0-rc.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-13318Medium· 6.4KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
CVE-2025-64436Medium· 5.3KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
CVE-2024-33394Medium· 5.9kubevirt allows a local attacker to execute arbitrary code via a crafted command
CVE-2025-64324High· 7.7KubeVirt Vulnerable to Arbitrary Host File Read and Write
CVE-2025-64437Medium· 5.0KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
GHSA-qv98-3369-g364HighKubeVirt vulnerable to arbitrary file read on host