Description
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kubevirt | 1.1.1-150600.5.3.2 | SUSE-SU-2024:2318-1 |
| SLES 15 SP5 | kubevirt | 1.1.1-150500.8.18.1 | SUSE-SU-2024:2246-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | kubevirt | 1.1.1-150500.8.18.1 | SUSE-SU-2024:2246-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kubevirt | 1.2.2-2.1 | openSUSE-SU-2024:14058-1 |
| openSUSE Tumbleweed | kubevirt1.8 +1 | 1.8.3-1.1 | openSUSE-SU-2026:11091-1, openSUSE-SU-2026:11057-1 |
| openSUSE Leap 15.6 | kubevirt | 1.1.1-150600.5.3.2 | SUSE-SU-2024:2318-1 |
| openSUSE Leap 15.5 | kubevirt | 1.1.1-150500.8.18.1 | SUSE-SU-2024:2246-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.5.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | kubevirt | 0.59.0-30 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | kubevirt.io/kubevirt | <= 1.2.0 | — | GHSA-4q63-mr2m-57hf |
| Go | kubevirt.io/kubevirt | all versions | — | GO-2024-2816 |
Advisories 5
- openSUSE-SU-2026:11091-1 kubevirt1.8-container-disk-1.8.3-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:11057-1 kubevirt-1.8-container-disk-1.8.3-1.1 on GA media SUSE / openSUSE Security Updates · Jun 19, 2026
- SUSE-SU-2024:2318-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2246-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14058-1 kubevirt-container-disk-1.2.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026