Skip to content
fr Sign in
9.9 Critical

CVE-2026-7374 A flaw was found in KubeVirt's virt-handler component

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Container Native Virtualization 4.12 1779375376 earliest → < 1779375376 1779375376
Red Hat Container Native Virtualization 4.13 1778999881 earliest → < 1778999881 1778999881
Red Hat Container Native Virtualization 4.14 1779321599 earliest → < 1779321599 1779321599
Red Hat Container Native Virtualization 4.15 1778859977 earliest → < 1778859977 1778859977
Red Hat Container Native Virtualization 4.16 1778861274 earliest → < 1778861274 1778861274
Red Hat Container Native Virtualization 4.17 1779174925 earliest → < 1779174925 1779174925
Red Hat Container Native Virtualization 4.18 1778887155 earliest → < 1778887155 1778887155
Red Hat Container Native Virtualization 4.2 1779288737 earliest → < 1779288737 1779288737
Show the 3 other branches
Product Affected versions Fixed in
Red Hat Container Native Virtualization 4.21 1779420069 earliest → < 1779420069 1779420069
Red Hat Container Native Virtualization 4.19 1779289071 earliest → < 1779289071 1779289071
Red Hat Container Native Virtualization 4.20 1779288737 earliest → < 1779288737 1779288737

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Virtualization 4

The 96 CVEs of Red Hat OpenShift Virtualization 4 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-102623 A flaw was found in KubeVirt 6.5 Medium CVE-2026-79699 A flaw was found in the containers/storage library 4.4 Medium
Track this CVE