Aller au contenu
en Se connecter
9.9 Critique

CVE-2026-7374 A flaw was found in KubeVirt's virt-handler component

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat OpenShift Virtualization 4 Versions non publiées
Red Hat Container Native Virtualization 4.12 1779375376 premières → < 1779375376 1779375376
Red Hat Container Native Virtualization 4.13 1778999881 premières → < 1778999881 1778999881
Red Hat Container Native Virtualization 4.14 1779321599 premières → < 1779321599 1779321599
Red Hat Container Native Virtualization 4.15 1778859977 premières → < 1778859977 1778859977
Red Hat Container Native Virtualization 4.16 1778861274 premières → < 1778861274 1778861274
Red Hat Container Native Virtualization 4.17 1779174925 premières → < 1779174925 1779174925
Red Hat Container Native Virtualization 4.18 1778887155 premières → < 1778887155 1778887155
Red Hat Container Native Virtualization 4.2 1779288737 premières → < 1779288737 1779288737
Afficher les 3 autres branches
Produit Versions touchées Corrigé en
Red Hat Container Native Virtualization 4.21 1779420069 premières → < 1779420069 1779420069
Red Hat Container Native Virtualization 4.19 1779289071 premières → < 1779289071 1779289071
Red Hat Container Native Virtualization 4.20 1779288737 premières → < 1779288737 1779288737

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat OpenShift Virtualization 4

Les 96 CVE de Red Hat OpenShift Virtualization 4 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Moyenne CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 Élevée CVE-2026-102623 A flaw was found in KubeVirt 6.5 Moyenne CVE-2026-79699 A flaw was found in the containers/storage library 4.4 Moyenne
Suivre cette CVE