CVE-2026-7374 — Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Description (CNA)

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 0 before 1.6.6; affected 1.7.0 before 1.7.4; affected 1.8.0 before 1.8.3
Red Hat / Red Hat Container Native Virtualization 4.12	unaffected 1779375376 before *
Red Hat / Red Hat Container Native Virtualization 4.13	unaffected 1778999881 before *
Red Hat / Red Hat Container Native Virtualization 4.14	unaffected 1779321599 before *
Red Hat / Red Hat Container Native Virtualization 4.15	unaffected 1778859977 before *
Red Hat / Red Hat Container Native Virtualization 4.16	unaffected 1778861274 before *
Red Hat / Red Hat Container Native Virtualization 4.17	unaffected 1779174925 before *
Red Hat / Red Hat Container Native Virtualization 4.18	unaffected 1778887155 before *
Red Hat / Red Hat Container Native Virtualization 4.19	unaffected 1779289071 before *
Red Hat / Red Hat Container Native Virtualization 4.20	unaffected 1779288737 before *
Red Hat / Red Hat Container Native Virtualization 4.21	unaffected 1779420069 before *

CWE

CWE-59

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP