By vendor

Kubevirt vulnerabilities

Known CVEs affecting Kubevirt products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-13201HIGH 7.3

  KubeVirt's file path handling contains a symlink-following vulnerability that allows attackers with pod-level access to compromise virtual machine management. An attacker in a virt-launcher pod can intercept management socket communications, inject fake VM lifecycle events, or manipulate file ownership on host paths. The result is that virt-handler—the component responsible for VM lifecycle management—can be tricked into corrupting VM state, crashing, or denying service to all VMs on an affected node.

• CVE-2026-13208MEDIUM 6.5

  KubeVirt's virt-handler service has a flaw in how it validates incoming event messages from virt-launcher pods running on the same node. When a virt-launcher process sends updates about a virtual machine instance (VMI), the handler accepts the VMI identity directly from the message content without verifying that the sender is actually authorized to update that specific VMI. A compromised virt-launcher could exploit this to send fake lifecycle events for other VMIs on the same node, causing the handler to incorrectly update their state and disrupt normal operations.