High8.5Vendor: MediumRed Hat Linux Updated
DisableTLS migration setting removes authentication, exposing unauthenticated virtqemud proxy on all interfaces
CVE-2026-13325 Published Jun 26, 2026Updated by vendor Jun 26, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Summary
DisableTLS migration setting removes authentication, exposing unauthenticated virtqemud proxy on all interfaces. Red Hat rates this moderate (CVSS 8.5). Weakness: CWE-306.
Mitigation checklist
Recommended fix / mitigation
- Do not set spec.configuration.migrations.disableTLS to true on the KubeVirt custom resource. The default value (false) enforces mutual TLS authentication on migration proxy connections and fully prevents this attack. If disableTLS must remain enabled for operational reasons, deploy Kubernetes NetworkPolicies restricting ingress to virt-handler pods to only allow connections from other virt-handler and virt-launcher pods. Note that configuring a dedicated migration network via migrations.network alone does not mitigate this flaw, as the listener binds on all interfaces regardless of the migration network configuration.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.