https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 07:39:55 +0000 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13325 <p>Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.</p> <p>Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13325 https://cve.radiocsirt.org/vuln/ghsa-r578-whjq-mcfv <p>A flaw was found in KubeVirt&#39;s migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher&#39;s virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant&#39;s virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing &#34;the additional layer of live migration encryption&#34; without disclosing that it also removes all mutual authentication.</p> <p>A flaw was found in KubeVirt&#39;s migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher&#39;s virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant&#39;s virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing &#34;the additional layer of live migration encryption&#34; without disclosing that it also removes all mutual authentication.</p> https://cve.radiocsirt.org/vuln/ghsa-r578-whjq-mcfv https://cve.radiocsirt.org/vuln/msrc_cve-2026-13325 msrc_CVE-2026-13325 https://cve.radiocsirt.org/vuln/msrc_cve-2026-13325