https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:05:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330309 EUVD-2026-330309 https://cve.radiocsirt.org/vuln/euvd-2026-330309 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13208 <p>A flaw was found in KubeVirt&#39;s virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection&#39;s origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI&#39;s state and disrupt its lifecycle management.</p> <p>A flaw was found in KubeVirt&#39;s virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection&#39;s origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI&#39;s state and disrupt its lifecycle management.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13208 https://cve.radiocsirt.org/vuln/ghsa-72r2-m3hg-cvf5 <p>A flaw was found in KubeVirt&#39;s virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection&#39;s origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI&#39;s state and disrupt its lifecycle management.</p> <p>A flaw was found in KubeVirt&#39;s virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection&#39;s origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI&#39;s state and disrupt its lifecycle management.</p> https://cve.radiocsirt.org/vuln/ghsa-72r2-m3hg-cvf5 https://cve.radiocsirt.org/vuln/msrc_cve-2026-13208 msrc_CVE-2026-13208 https://cve.radiocsirt.org/vuln/msrc_cve-2026-13208