Kubevirt vulnerabilities
We track 3 vulnerabilities in Kubevirt products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2026.
Latest Kubevirt vulnerabilities
- 7.3 High severity
Red Hat Container Native Virtualization 4.12: UNIX Symbolic Link (Symlink) Following
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. W
- 7.7 High severity
kubevirt: Exposure of Sensitive Information to an Unauthorized Actor
KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature
- 8.2 High severity
kubevirt: Incorrect Authorization
KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify