kubevirt.io/kubevirt vulnerabilities
CVEs whose affected-version data names the kubevirt.io/kubevirt package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-13318Medium· 6.4KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
CVE-2026-13218Medium· 4.2KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
CVE-2025-64324High· 7.7KubeVirt Vulnerable to Arbitrary Host File Read and Write
KubeVirt Vulnerable to Arbitrary Host File Read and Write
CVE-2025-64436Medium· 5.3KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
CVE-2025-64437Medium· 5.0KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
CVE-2024-33394Medium· 5.9kubevirt allows a local attacker to execute arbitrary code via a crafted command
kubevirt allows a local attacker to execute arbitrary code via a crafted command
GHSA-qv98-3369-g364HighKubeVirt vulnerable to arbitrary file read on host
KubeVirt vulnerable to arbitrary file read on host