High [CVE-2026-13622] virt-handler migration proxy follows symlinks allowing container escape to host
This high-severity Red Hat Linux advisory covers CVE-2026-13622 affecting Red Hat Container Native Virtualization 4.12, Red Hat Container Native Virtualization 4.13, Red Hat Container Native Virtualization 4.14.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.
Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user.
An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket.
Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise. Red Hat has rated this vulnerability as Important impact.
The vulnerable code is in the virt-handler component, a privileged DaemonSet running as root in the host mount namespace on every compute node. Exploitation requires an authenticated user with namespace-level edit permissions (kubevirt.io:edit) and pods/exec access — standard permissions for VM operators.
The impact of successful exploitation is complete node compromise via CRI-O socket access, bypassing all Kubernetes admission controls. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Weakness: CWE-22.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
- container-native-virtualization/virt-handler:1785837722
- container-native-virtualization/virt-handler-rhel9:1786346596
- container-native-virtualization/virt-handler-rhel9:1786309624
- container-native-virtualization/virt-handler-rhel9:1786347656
- container-native-virtualization/virt-handler-rhel9:1786030071
- container-native-virtualization/virt-handler-rhel9:1786348529
- container-native-virtualization/virt-handler-rhel9:1786130068
- container-native-virtualization/virt-handler-rhel9:1786334215
- container-native-virtualization/virt-handler-rhel9:1785831334
- container-native-virtualization/virt-handler-rhel9:1785829701
- container-native-virtualization/virt-handler-rhel9:1785140336
- RHEA-2026:53670
- RHSA-2026:53655
- RHSA-2026:53671
- RHSA-2026:53826
- RHSA-2026:53721
- RHSA-2026:53684
- RHSA-2026:53838
- RHSA-2026:53797
- RHSA-2026:53763
- RHSA-2026:53728
- RHSA-2026:51031
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Mitigation checklist
- Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.
Official advisory · high-confidence parse· fetched 28 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.