CVE-2026-13622

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description A symlink following issue exists in the KubeVirt virt-handler migration proxy. During live migration, virt-handler uses net.Dial() to connect to Unix sockets within the target virt-launcher pod via /proc/<pid>/root/ paths without implementing symlink protection. Since these socket paths are located in directories owned by qemu and writable by the virt-launcher user, an attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink pointing to the host CRI-O socket. Because virt-handler operates as root within the host mount namespace, absolute symlink targets are resolved against the host filesystem. The bidirectional io.Copy proxy then relays attacker-controlled data to the container runtime, which can lead to full node compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.