Red Hat Container Native Virtualization 4.13 vulnerabilities

6 known vulnerabilities in Red Hat Container Native Virtualization 4.13 from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Red Hat Container Native Virtualization 4.12: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-13622Aug 12, 2026Red Hat

  A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These so

• 7.3 High severity

  Red Hat Container Native Virtualization 4.12: UNIX Symbolic Link (Symlink) Following

  CVE-2026-13201Jun 24, 2026Red Hat

  A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. W

• 7.7 High severity

  axios: Improper Control of Generation of Code

  CVE-2026-44495Jun 11, 2026Axios

  Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Obj

• 8.7 High severity

  axios: Unintended Proxy or Intermediary

  CVE-2026-44494Jun 11, 2026AxiosEPSS 1.06%

  Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escala

• 8.6 High severity

  axios: Server-Side Request Forgery

  CVE-2026-44492Jun 11, 2026AxiosEPSS 12.3%

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv

• 9.9 Critical severity

  Red Hat Container Native Virtualization 4.12: Improper Link Resolution Before File Access

  CVE-2026-7374May 26, 2026Red Hat

  A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing