CVE-2026-13325

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description A flaw exists in the migration proxy where setting spec.configuration.migrations.disableTLS to true on the KubeVirt custom resource causes the target virt-handler to bind a plain TCP listener on all interfaces (0.0.0.0/::) using a random port. This listener lacks authentication, peer allow-lists, or handshake tokens, and proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a pod on the cluster network can connect to this listener to execute unfiltered libvirt RPC commands against another tenant's virtual machine. Potential impacts include reading VM memory and configuration, modifying VM state via QMP (QEMU Machine Protocol), or destroying the VM. Configuring a dedicated migration network via migrations.network does not mitigate this, as the listener bind address remains 0.0.0.0.

Recommendations Avoid setting the spec.configuration.migrations.disableTLS parameter to true to ensure mutual authentication and encryption remain enabled for migrations.