Kubevirt vulnerabilities

Products

• Kubevirt 18

Newest

• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled CVE-2026-13434 4.9 MediumJune 26, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service CVE-2026-13322 3.8 LowJune 26, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip CVE-2026-13318 Fix available 6.4 MediumJune 25, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher CVE-2026-13218 4.2 MediumJune 25, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body CVE-2026-13208 6.5 MediumJune 24, 2026
• kubevirt, red hat container native virtualization 4.12, container native virtualization 4.13 +10 more +12 more Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption CVE-2026-13201 Fix available 7.3 HighJune 24, 2026
• kubevirt KubeVirt Vulnerable to Arbitrary Host File Read and Write CVE-2025-64324 Fix available 8.5 HighNovember 7, 2025
• kubevirt KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes CVE-2025-64437 Fix available 5.0 MediumNovember 6, 2025
• kubevirt KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes CVE-2025-64436 Fix available 6.9 MediumNovember 6, 2025
• kubevirt KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation CVE-2025-64435 Fix available 5.3 MediumNovember 6, 2025
• kubevirt KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing CVE-2025-64434 Fix available 4.7 MediumNovember 6, 2025
• kubevirt KubeVirt Arbitrary Container File Read CVE-2025-64433 Fix available 6.5 MediumNovember 6, 2025
• kubevirt KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer CVE-2025-64432 Fix available 4.7 MediumNovember 6, 2025
• kubevirt kubevirt allows a local attacker to execute arbitrary code via a crafted command CVE-2024-33394 Fix available 5.9 MediumMay 2, 2024
• kubevirt On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs CVE-2023-26484 Fix available 8.2 HighMarch 15, 2023
• google llc kubevirt Path Traversal vulnerability in Kubevirt CVE-2022-1798 Fix available 8.7 HighAugust 18, 2022
• kubevirt Permissions bypass in KubeVirt CVE-2020-1701 Fix available 6.5 MediumMay 27, 2021
• kubevirt, redhat openshift virtualization +1 more Privilege Escalation in kubevirt CVE-2020-14316 Fix available 9.9 CriticalJuly 29, 2020
• kubevirt containerized-data-importer A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the... CVE-2019-10175 6.5 MediumJune 28, 2019
• the kubevirt project kubevirt/virt-cdi-importer, kubevirt containerized data importer +1 more Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS... CVE-2019-3841 7.4 HighMarch 25, 2019