CVE-2026-7374Critical· 9.9▾ MidnightA flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine consol…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
0.6% → 0.8%
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4kubevirt.io/kubevirt < 1.6.6Patched in:
kubevirt.io/kubevirt 1.8.3kubevirt.io/kubevirt 1.7.4kubevirt.io/kubevirt 1.6.6Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1753High· 8.6A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers
CVE-2026-115378Medium· 5.8github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)
CVE-2026-108119Medium· 6.3A flaw was found in busybox
CVE-2026-13201High· 7.3A flaw was found in KubeVirt's safepath package used by virt-handler
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)