CVE-2026-13622Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Container Native Virtualization 4.12. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 21, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Container Native Virtualization 4.12 redhat:container_native_virtualization | from 1785837722 not affected | CNA record |
References
- https://access.redhat.com/errata/RHEA-2026:53670vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:51031vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53655vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53671vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53684vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53721vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53728vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53763vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53797vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53826vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:53838vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2026-13622vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2494142issue-tracking, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.