Vulnerability-Lookup

RHSA-2026:80941

Vulnerability from csaf_redhat - Published: 2026-10-12 12:45 - Updated: 2026-10-12 20:59

Summary

Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

Severity

Moderate

Notes

Topic: Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.

Details: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.12 images.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-13201

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

CWE-61 - UNIX Symbolic Link (Symlink) Following

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64		—	Vendor Fix fix Workaround

Known not affected 8 products

Product	Version	Remediation
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64	—	Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64	—	Workaround

Threats

Impact Moderate

References

8 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:80941	self
https://access.redhat.com/security/cve/CVE-2026-13201	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-13201	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492203	external
https://www.cve.org/CVERecord?id=CVE-2026-13201	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13201	external

Acknowledgments

Red Hat Huzaifa Sidhpurwala

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.12 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:80941",
        "url": "https://access.redhat.com/errata/RHSA-2026:80941"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13201",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13201"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80941.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.12 Images",
    "tracking": {
      "current_release_date": "2026-10-12T20:59:09+00:00",
      "generator": {
        "date": "2026-10-12T20:59:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:80941",
      "initial_release_date": "2026-10-12T12:45:21+00:00",
      "revision_history": [
        {
          "date": "2026-10-12T12:45:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-12T12:45:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-12T20:59:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.12",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.12",
                  "product_id": "Red Hat Container Native Virtualization 4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/libguestfs-tools@sha256%3Ac5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/libguestfs-tools\u0026tag=1791522741"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-api@sha256%3Aae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-api\u0026tag=1791522806"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-artifacts-server@sha256%3A1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-artifacts-server\u0026tag=1791522790"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-controller@sha256%3Ad43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-controller\u0026tag=1791522788"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-exportproxy@sha256%3A694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-exportproxy\u0026tag=1791522738"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-exportserver@sha256%3Acc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-exportserver\u0026tag=1791522835"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-handler@sha256%3A8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-handler\u0026tag=1791522624"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-launcher@sha256%3Aa50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-launcher\u0026tag=1791522593"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/virt-operator@sha256%3A86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/virt-operator\u0026tag=1791522766"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Huzaifa Sidhpurwala"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-13201",
      "cwe": {
        "id": "CWE-61",
        "name": "UNIX Symbolic Link (Symlink) Following"
      },
      "discovery_date": "2026-06-24T13:52:04.691000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492203"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in KubeVirt\u0027s safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler\u0027s IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in KubeVirt\u0027s safepath package where OpenAtNoFollow obtains a file descriptor to a leaf symlink using O_PATH|O_NOFOLLOW, then downstream operations resolve the path via /proc/self/fd/N which dereferences the symlink, defeating the intended no-follow protection.\n\nThe primary impact is through notify socket hijacking: virt-handler uses safepath to resolve the path to the notify socket inside each virt-launcher pod. A namespace-level tenant with pod access can replace this socket path with a symlink to an attacker-controlled socket, enabling injection of arbitrary VM domain lifecycle events. Since virt-handler treats this as a trusted IPC channel, injected events are processed without validation and propagated to the Kubernetes API as VMI status updates. This allows the attacker to trigger incorrect VM lifecycle actions (shutdowns, restarts, migrations), corrupt VMI resource state, or crash the virt-handler process through malformed events. Because virt-handler is a single DaemonSet pod per node, a sustained crash loop denies VM management services \u2014 including console access, live migration, and lifecycle operations \u2014 for all virtual machines on that node.\n\nA secondary impact exists through the chown/chmod path: virt-handler (running as root on the node) can be tricked into applying file ownership or permission changes to arbitrary host files with hardcoded values. This modification is blind \u2014 the attacker cannot read or write file contents and remains confined to the container. In default OpenShift Virtualization deployments, SELinux mandatory access controls and RHCOS immutable filesystem layers limit the set of targetable host files.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13201"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492203",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13201",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13201"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13201",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13201"
        }
      ],
      "release_date": "2026-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-12T12:45:21+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:80941"
        },
        {
          "category": "workaround",
          "details": "The following measures reduce the attacker pool and limit secondary impact:\n\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker\u0027s ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability.",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64",
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption"
    }
  ]
}

CVE-2026-13201 (GCVE-0-2026-13201)

Vulnerability from cvelistv5 – Published: 2026-06-24 20:39 – Updated: 2026-09-21 17:14

Title

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Summary

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 23:04 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

redhat redhat root Scorecard

References

12 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:51031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53655	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53671	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53684	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53721	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53728	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53763	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53826	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53838	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-13201	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492203	issue-trackingx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
Red Hat	Red Hat Container Native Virtualization 4.13	Unaffected: 1786346596 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.13::el9
Red Hat	Red Hat Container Native Virtualization 4.14	Unaffected: 1786309624 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.14::el9
Red Hat	Red Hat Container Native Virtualization 4.15	Unaffected: 1786347656 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.15::el9
Red Hat	Red Hat Container Native Virtualization 4.16	Unaffected: 1786030071 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.16::el9
Red Hat	Red Hat Container Native Virtualization 4.17	Unaffected: 1786348529 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.17::el9
Red Hat	Red Hat Container Native Virtualization 4.18	Unaffected: 1786130068 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.18::el9
Red Hat	Red Hat Container Native Virtualization 4.19	Unaffected: 1786334215 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat	Red Hat Container Native Virtualization 4.20	Unaffected: 1785831334 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.20::el9
Red Hat	Red Hat Container Native Virtualization 4.21	Unaffected: 1785829701 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.21::el9
Red Hat	Red Hat Container Native Virtualization 4.22	Unaffected: 1785140336 , < * (rpm) cpe:/a:redhat:container_native_virtualization:4.22::el9
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4

Date Public

2026-06-24 00:00

Credits

This issue was discovered by Huzaifa Sidhpurwala (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T23:04:34.331359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T23:04:48.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786346596",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786309624",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786347656",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786030071",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786348529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786130068",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.19::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786334215",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.20::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.20",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785831334",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.21::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.21",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785829701",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785140336",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Huzaifa Sidhpurwala (Red Hat)."
        }
      ],
      "datePublic": "2026-06-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in KubeVirt\u0027s safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler\u0027s IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T17:14:15.809Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:51031",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:51031"
        },
        {
          "name": "RHSA-2026:53655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53655"
        },
        {
          "name": "RHSA-2026:53671",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53671"
        },
        {
          "name": "RHSA-2026:53684",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53684"
        },
        {
          "name": "RHSA-2026:53721",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53721"
        },
        {
          "name": "RHSA-2026:53728",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53728"
        },
        {
          "name": "RHSA-2026:53763",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53763"
        },
        {
          "name": "RHSA-2026:53797",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53797"
        },
        {
          "name": "RHSA-2026:53826",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53826"
        },
        {
          "name": "RHSA-2026:53838",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53838"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-13201"
        },
        {
          "name": "RHBZ#2492203",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-24T13:52:04.691Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following measures reduce the attacker pool and limit secondary impact:\n\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker\u0027s ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-61: UNIX Symbolic Link (Symlink) Following"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-13201",
    "datePublished": "2026-06-24T20:39:00.173Z",
    "dateReserved": "2026-06-24T13:58:29.925Z",
    "dateUpdated": "2026-09-21T17:14:15.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:80941

CVE-2026-13201 (GCVE-0-2026-13201)

Tags

Sightings

Nomenclature

Related by attack behaviour