CVE-2026-13434

Name of the Vulnerable Software and Affected Versions KubeVirt versions 1.8.0 and later

Description A flaw exists in the network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the networkName value is written directly into the launcher pod's v1.multus-cni.io/default-network annotation without proper format validation or sanitization. While empty strings are rejected, the system fails to perform DNS-1123 format validation, JSON detection, or special character rejection. If the ExternalNetResourceInjection Beta feature gate is enabled, the Network Attachment Definition (NAD) lookup is skipped. This allows a tenant with kubevirt.io:edit permissions to inject a JSON-formatted NetworkSelectionElement array. Consequently, Multus may attach the launcher pod to a specified network attachment in any namespace, leading to cross-namespace network access and IP/MAC impersonation on segregated network segments.

Recommendations Disable the ExternalNetResourceInjection Beta feature gate to prevent the bypass of NAD lookups. At the moment, there is no information about a newer version that contains a fix for this vulnerability.