Description
KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kubevirt | kubevirt | <= 1.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.6.3-1 | — |
| Azure Linux 2 (CBL-Mariner) | kubevirt | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-machine-driver-harvester | 1.0.5-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubevirt/kubevirt | all versions | — | GO-2025-4104 |
| Go | kubevirt.io/kubevirt | < 1.7.0 | 1.7.0 | GHSA-7xgm-5prm-v5gc |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- WID-SEC-2025-2563 Microsoft Azure Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026