Red Hat Container Native Virtualization 4.12 vulnerabilities

3 known vulnerabilities in Red Hat Container Native Virtualization 4.12 from Red Hat. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Red Hat Container Native Virtualization 4.12: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-13622Aug 12, 2026Red Hat

  A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These so

• 7.3 High severity

  Red Hat Container Native Virtualization 4.12: UNIX Symbolic Link (Symlink) Following

  CVE-2026-13201Jun 24, 2026Red Hat

  A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. W

• 9.9 Critical severity

  Red Hat Container Native Virtualization 4.12: Improper Link Resolution Before File Access

  CVE-2026-7374May 26, 2026Red Hat

  A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing