CVE-2025-64436

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.0

Description KubeVirt, a virtual machine management add-on for Kubernetes, has an issue where permissions granted to the virt-handler service account could be misused. Specifically, the ability to update VMIs and patch nodes could be exploited to force a VMI migration to a node controlled by an attacker. This could allow an attacker to mark all nodes as unschedulable, potentially leading to the migration or creation of privileged pods onto a compromised node.

Recommendations Update to a version of KubeVirt greater than or equal to 1.5.0.