Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-6383 EUVD-2026-23009GHSA-j6cv-3w8p-vrg8GO-2026-5450

Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

Published Apr 15, 2026 · Updated Apr 15, 2026 · Assigned by redhat

Description

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift Virtualization 4 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kubevirt 1.8.4-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling docker-machine-driver-harvester 1.1.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go kubevirt.io/kubevirt <= 1.8.1 — GHSA-j6cv-3w8p-vrg8
Go kubevirt.io/kubevirt all versions — GO-2026-5450

Advisories 1

References