CVE-2026-13318: KubeVirt SSRF via Untrusted Guest IP in Port-Forward Handler

Technical summary

The vulnerability exists in KubeVirt's virt-api port-forward handler, which processes port-forward requests to VirtualMachineInstance (VMI) objects. The handler retrieves the target IP address from vmi.Status.Interfaces[0].IP—a field populated by the QEMU guest agent running inside the VM—and passes it directly to net.Dial() without any validation or sanitization. For VMs using non-masquerade network modes (bridge or secondary-only), this IP address is fully under the control of the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that spoofs an arbitrary IP address, then issue port-forward requests to establish a bidirectional TCP tunnel from virt-api's cluster-internal network context to any routable destination, effectively sidestepping NetworkPolicy enforcement.

Business impact

This vulnerability enables lateral movement within Kubernetes clusters running KubeVirt. An insider or compromised account with VM creation permissions can use port-forwarding as a covert channel to reach internal services, databases, or cloud infrastructure that would normally be protected by network policies. The impact is heightened in multi-tenant or restricted-access environments where NetworkPolicy is relied upon to enforce network segmentation. While the vulnerability requires authentication (kubevirt.io:edit), the ease of exploitation and the breadth of potential targets make it a significant security concern for organizations using KubeVirt for virtualization workloads.

Affected systems

KubeVirt (upstream project) and Red Hat OpenShift Virtualization are affected. The vulnerability applies to deployments where virt-api is exposed and VMs use non-masquerade network bindings. Masquerade-mode networking may provide some protection because the guest agent cannot control the IP address in that configuration, but non-masquerade modes (bridge, SR-IOV, secondary networks) are directly vulnerable. The exact affected versions should be verified against Red Hat and KubeVirt advisories.

Exploitability

Exploitation requires authentication: the attacker must have kubevirt.io:edit permissions to create or modify VMs. This elevates the barrier from unauthenticated attacks but does not eliminate risk in environments where such permissions are granted to developers, operators, or service accounts with broad access. The attack itself is straightforward—create a VM with a spoofed guest agent, then issue a port-forward request—and requires no special tools or knowledge of internal infrastructure. The CVSS score of 6.4 (MEDIUM) reflects the requirement for authenticated access and the indirect impact on confidentiality and integrity, rather than availability or privilege escalation.

Remediation

Organizations using KubeVirt should apply available security patches as soon as they become available. Upstream KubeVirt and Red Hat OpenShift Virtualization advisories will contain specific patch versions. Until patches are applied, mitigation strategies include: (1) restricting kubevirt.io:edit permissions to trusted users and service accounts; (2) enabling RBAC to limit which identities can create or modify VMs; (3) enforcing NetworkPolicy to restrict outbound traffic from virt-api pods, recognizing that this may conflict with legitimate port-forward use cases; and (4) monitoring port-forward requests for suspicious destination IPs outside expected ranges.

Patch guidance

Verify the latest security advisories from the KubeVirt project and Red Hat for patched versions. The fix will likely involve validating the target IP address against a whitelist, restricting it to the pod's own network range, or requiring explicit authorization for port-forward destinations. Apply patches to all virt-api components in your Kubernetes cluster. Test port-forward functionality in a non-production environment to ensure the patch does not break legitimate VM access workflows.

Detection guidance

Monitor virt-api logs and audit records for port-forward requests with unusual destination IP addresses, particularly those outside your expected VM or cluster subnets. Track calls to net.Dial() with attacker-controlled parameters if your environment supports eBPF or kernel-level tracing. Review RBAC audit logs for grants of kubevirt.io:edit permissions and cross-reference VM creation events with subsequent port-forward attempts. Network monitoring tools may detect outbound traffic from virt-api pods to unexpected destinations. In Kubernetes, examine vmi.Status.Interfaces[0].IP values for IPs that do not match the underlying QEMU instance or guest OS configuration.

Why prioritize this

While the CVSS score is MEDIUM, this vulnerability merits prompt attention because: (1) it enables SSRF from a privileged cluster-internal position, bypassing NetworkPolicy controls; (2) exploitation is straightforward once an attacker has VM creation permissions; (3) the impact—unauthorized access to internal services—can be severe in multi-tenant or restricted-access environments; and (4) the vulnerability may not be immediately detected by standard network monitoring. Prioritize patching in clusters with high-sensitivity workloads or where VM access is granted to less-trusted users.

Risk score, explained

CVE-2026-13318 is scored 6.4 (MEDIUM) on CVSS 3.1 because it requires authenticated access (PR:L), has low attack complexity (AC:L), is network-accessible (AV:N), and impacts the confidentiality and integrity of systems reachable from virt-api (C:L/I:L), but not availability (A:N). The score does not increase to HIGH because a successful exploit does not grant the attacker higher privileges on the cluster itself—rather, it grants access to systems accessible from virt-api's network position. Organizations relying on NetworkPolicy for isolation should view this as a higher-severity finding in their risk context.

Frequently asked questions