Description
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | kubevirt | < 1.6.6, 1.7.0 – < 1.7.4, 1.8.0 – < 1.8.3 | 1.6.6 |
| Red Hat | Red Hat Container Native Virtualization 4.12 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.13 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.14 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.15 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.16 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.17 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kubevirt | 1.7.4-150700.3.24.2 | SUSE-SU-2026:2400-1 |
| SLES 15 SP7 | kubevirt-1.6 | 1.6.6-150700.15.7.1 | SUSE-SU-2026:2401-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.7.1-7 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-machine-driver-harvester | 1.0.6-r13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | kubevirt.io/kubevirt | >= 1.8.0-alpha.0, < 1.8.3 | 1.8.3 | GHSA-7jcp-v9w4-wjmg |
| Go | kubevirt.io/kubevirt | >= 1.7.0-alpha.0, < 1.7.4 | 1.7.4 | GHSA-7jcp-v9w4-wjmg |
| Go | kubevirt.io/kubevirt | < 1.6.6 | 1.6.6 | GHSA-7jcp-v9w4-wjmg |
| Go | kubevirt.io/kubevirt | < 1.6.6 · >= 1.7.0-alpha.0, < 1.7.4 · >= 1.8.0-alpha.0, < 1.8.3 | 1.6.6, 1.7.4, 1.8.3 | GO-2026-5848 |
Advisories 4
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- WID-SEC-2026-1680 Red Hat OpenShift Virtualization: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jun 16, 2026
- SUSE-SU-2026:2400-1 Security update for kubevirt SUSE / openSUSE Security Updates · Jun 16, 2026
- SUSE-SU-2026:2401-1 Security update for kubevirt-1.6 SUSE / openSUSE Security Updates · Jun 16, 2026
References
- RHSA-2026:20720 vendor-advisory
- RHSA-2026:20736 vendor-advisory
- RHSA-2026:20763 vendor-advisory
- RHSA-2026:20767 vendor-advisory
- RHSA-2026:20782 vendor-advisory
- RHSA-2026:20825 vendor-advisory
- RHSA-2026:20866 vendor-advisory
- RHSA-2026:20886 vendor-advisory
- RHSA-2026:20890 vendor-advisory
- RHSA-2026:20975 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-7374 vdb-entry
- RHBZ#2463728 issue-tracking