Medium4.9Red Hat Linux Updated

Multus default-network annotation injection via unvalidated tenant networkName when ExternalNetResourceInjection is enabled

CVE-2026-13434 Published Jun 26, 2026Updated by vendor Jun 26, 2026

CVE-2026-13434

Affected products & platforms

Red Hat LinuxUnclassified

Summary

Multus default-network annotation injection via unvalidated tenant networkName when ExternalNetResourceInjection is enabled. Red Hat rates this moderate (CVSS 4.9). Weakness: CWE-20.

Mitigation checklist

Recommended fix / mitigation

If the ExternalNetResourceInjection feature gate has been enabled, disable it by removing it from the HyperConverged CR's spec.featureGates configuration. This restores the NAD lookup that blocks malformed network names. If the feature gate is required for operational reasons, restrict kubevirt.io:edit permissions to trusted users only and enforce NetworkPolicy on sensitive network segments to limit lateral movement from unauthorized attachments.

Official advisory · high-confidence parse· fetched 7 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.