CVE-2026-13434
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A flaw in KubeVirt's network annotation generator allows a tenant with kubevirt.io:edit permissions to inject JSON into the v1.multus-cni.io/default-network annotation due to missing validation. When the ExternalNetResourceInjection feature gate is enabled (off by default), Multus can attach the pod to any network in any namespace.
Risk Assessment
The organization risks unauthorized cross-namespace network access and IP/MAC impersonation, breaking network isolation and enabling privilege escalation in multi-tenant environments.
Recommendation
Disable the ExternalNetResourceInjection feature gate if not needed, and update KubeVirt to a patched version. For OpenShift Virtualization 4.21+, apply the relevant security fixes.
Other vulnerabilities in KubeVirt
See all- CVE-2026-7374Critical
A flaw was found in KubeVirt's virt-handler component due to improper symlink validation when connecting to virtual machine console sockets. An authenticated OpenShift user with edit permissions in a single namespace can replace the console socket with a symlink to the host's CRI-O socket, hijacking virt-handler's privileged connection.
- CVE-2026-13622High
A symlink following vulnerability in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths without symlink protection. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket, enabling full node compromise.
- CVE-2026-13322Low
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
- CVE-2026-13318Medium
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner.
- CVE-2026-13218Medium
A flaw in KubeVirt's virt-handler network cache handling allows a user with access to the virt-launcher container to overwrite arbitrary host files with JSON content and change their ownership by planting a symlink at the cache file path.
- CVE-2026-13208Medium
A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers.
- CVE-2026-13201High
A flaw in KubeVirt's safepath package, used by virt-handler, was found in the OpenAtNoFollow function. It uses O_PATH|O_NOFOLLOW to obtain a file descriptor, but subsequent operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, bypassing the intended no-follow protection.
- CVE-2026-9804High
A path traversal vulnerability was found in KubeVirt's virt-exportserver component. An attacker with namespace-level access can place a symbolic link in an exported PVC pointing outside its mount root, allowing arbitrary file reads from the exporter pod's filesystem.
Original NVD description (English source)
A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or sanitization. The only admission check rejects empty strings; no DNS-1123 format validation, JSON detection, or special character rejection is performed. When the ExternalNetResourceInjection Beta feature gate is enabled (off by default, cluster-admin only), the NAD lookup that would otherwise catch malformed names is skipped by design. A tenant with kubevirt.io:edit permissions can inject a JSON-formatted NetworkSelectionElement array specifying an arbitrary namespace, NAD name, static IP address, and MAC address. Multus on the node parses this JSON and attaches the launcher pod to the specified network attachment in any namespace, enabling cross-namespace network access and IP/MAC impersonation on network segments normally segregated from tenant workloads. The ExternalNetResourceInjection feature gate was introduced in KubeVirt v1.8.0 (first shipped in OpenShift Virtualization 4.21).