CVE-2026-13318

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description A server-side request forgery (SSRF) flaw exists in the virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api retrieves the target IP from vmi.Status.Interfaces[0].IP and passes it to the net.Dial() function without validation. For VMIs using non-masquerade network bindings, such as bridge or secondary-only, this IP is reported by the QEMU guest agent within the VM and can be controlled by the VM owner. An attacker with kubevirt.io:edit permissions can configure a VM with a modified guest agent to report an arbitrary IP address. By requesting a port-forward, the attacker can establish a bidirectional TCP tunnel from the cluster-internal network position of virt-api to any routable destination, effectively bypassing NetworkPolicy isolation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.