---
id: CVE-2026-13218
aliases:
  - GHSA-q3jc-42cq-33fj
title: >-
  KubeVirt virt-handler network cache symlink vulnerability allows arbitrary
  host file overwrite
summary: >-
  KubeVirt virt-handler network cache symlink vulnerability allows arbitrary
  host file overwrite
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L'
vendor: kubevirt
product: kubevirt.io/kubevirt
ecosystem: go
affected:
  - kubevirt.io/kubevirt <= 1.10.0-rc.0
published: '2026-06-26'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T17:30:04.830667371Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-q3jc-42cq-33fj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13218'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-13218'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492654'
  - url: 'https://github.com/kubevirt/kubevirt'
  - url: >-
      https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103
  - url: 'https://github.com/advisories/GHSA-q3jc-42cq-33fj'
tags:
  - osv
  - go
  - ghsa
epss: 0.00139
epssPercentile: 0.03286
cwe:
  - CWE-61
ingestedAt: '2026-11-04T18:21:08.586Z'
---

## Overview

A flaw was found in KubeVirt's virt-handler network cache handling. The writeToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

## Affected packages

- `kubevirt.io/kubevirt <= 1.10.0-rc.0`

## Remediation

Refer to the advisory for the patched release.