4.2
Moyenne
CVE-2026-13218 A flaw was found in KubeVirt's virt-handler network cache handling
Description
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Virtualization 4 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2492654 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Virtualization 4
Les 96 CVE de Red Hat OpenShift Virtualization 4 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-102623
A flaw was found in KubeVirt
6.5
Moyenne
CVE-2026-79699
A flaw was found in the containers/storage library
4.4
Moyenne