Skip to content
Heist/ feed
Back to feed
Critical

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Type: advisorySources: OSV

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-7374
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 01:36 UTC · Revision 1

Source evidence

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

core-osv · Original source

Published 26 May 2026, 13:14 UTC

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

osv:CVE-2026-7374
Complete source record
{
  "id": "f1ffd47d4d57931a7a4951782d94ce9d42467a334e20ec2cf3997bb3cf9c3315",
  "url": "https://osv.dev/vulnerability/CVE-2026-7374",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability",
    "summary": "A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.",
    "evidence": "osv:CVE-2026-7374",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-7374",
      "aliases": [
        "CVE-2026-7374",
        "GHSA-7jcp-v9w4-wjmg",
        "GO-2026-5848"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/kubevirt/kubevirt",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "75581da2192a3c4f9e0c48e7e37255ed2257780d"
                },
                {
                  "introduced": "50b9b4d0cf1caaf56147411a1e6765134e0e82b9"
                },
                {
                  "fixed": "2468b19f25de2991433ba44e45419b2c0eaec20a"
                },
                {
                  "introduced": "85b6a25964132b0d578184598fb3c00d00d71f61"
                },
                {
                  "fixed": "540f37cfa3caed601ac6710cb002b11a249d0639"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.6.6"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.7.0"
                      },
                      {
                        "fixed": "1.7.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.8.0"
                      },
                      {
                        "fixed": "1.8.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.6.5",
            "v1.7.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0-rc.1",
            "v1.8.0",
            "v1.7.2",
            "v1.6.4",
            "v1.7.1",
            "v1.7.0-rc.1",
            "v1.7.0",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0-rc.1",
            "v1.6.0",
            "v1.6.0-rc.0",
            "v1.6.0-beta.0",
            "v1.6.0-alpha.0",
            "v1.5.0-beta.0",
            "v1.5.0-alpha.0",
            "v1.4.0-rc.0",
            "v1.4.0-alpha.1",
            "v1.4.0-alpha.0",
            "v1.3.0-beta.0",
            "v1.3.0-alpha.0",
            "v1.2.0-rc.0",
            "v1.2.0-beta.0",
            "v1.2.0-alpha.0",
            "v1.1.0-rc.0",
            "v1.1.0-alpha.0",
            "v1.0.0-beta.0",
            "v1.0.0-alpha.0",
            "v0.60.0-alpha.0",
            "v0.59.0-rc.1",
            "v0.59.0-rc.0",
            "v0.59.0-alpha.2",
            "v0.59.0-alpha.1",
            "v0.59.0-alpha.0",
            "v0.58.0-rc.0",
            "v0.58.0",
            "v0.57.0-rc.0",
            "v0.57.0",
            "v0.56.0-rc.0",
            "v0.55.0-rc.0",
            "v0.55.0",
            "v0.54.0-rc.0",
            "v0.54.0",
            "v0.53.0-rc.0",
            "v0.53.0",
            "v0.52.0-rc.0",
            "v0.52.0",
            "v0.51.0-rc.0",
            "v0.51.0",
            "v0.50.0-rc.0",
            "v0.50.0",
            "v0.49.0-rc.0",
            "v0.49.0",
            "v0.48.0-rc.0",
            "v0.48.0",
            "v0.47.0-rc.0",
            "v0.46.0-rc.0",
            "v0.46.0",
            "v0.45.0-rc.0",
            "v0.45.0",
            "v0.44.0-rc.0",
            "v0.44.0",
            "v0.43.1-rc.1",
            "v0.43.0-rc.0",
            "v0.35.0-rc.0",
            "v0.35.0",
            "v0.42.0-rc.0",
            "v0.42.0",
            "v0.41.0-rc.0",
            "v0.40.0-rc.0",
            "v0.39.0-rc.0",
            "v0.38.0-rc.0",
            "v0.38.0",
            "v0.37.0-rc.0",
            "v0.36.0-rc.0",
            "v0.34.0-rc.0",
            "v0.33.0-rc.0",
            "v0.32.0-rc.1",
            "v0.31.0-rc.1",
            "v0.31.0",
            "v0.30.0-rc.4",
            "v0.30.0",
            "v0.30.0-rc.2",
            "v0.30.0-rc.3",
            "v0.30.0-rc.0",
            "v0.30.0-rc.1",
            "v0.29.0-rc.1",
            "v0.29.0",
            "v0.29.0-rc.0",
            "v0.28.0-rc.2",
            "v0.28.0-rc.0",
            "v0.28.0-rc.1",
            "v0.28.0",
            "v0.27.0-rc.0",
            "v0.27.0",
            "v0.26.1",
            "v0.26.0-rc.0",
            "v0.26.0",
            "v0.25.0-rc.0",
            "v0.25.0",
            "v0.24.0",
            "v0.23.0",
            "v0.22.0",
            "v0.21.0",
            "v0.20.0",
            "v0.19.0-rc.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.17.0-alpha.1",
            "v0.17.0-alpha.0",
            "v0.16.0",
            "v0.16.0-alpha.0",
            "v0.15.0",
            "v0.15.0-alpha.0",
            "v0.14.0",
            "v0.13.0",
            "v0.12.0",
            "v0.12.0-alpha.3",
            "v0.12.0-alpha.2",
            "v0.12.0-alpha.1",
            "v0.11.1",
            "v0.10.0",
            "v0.11.0",
            "v0.12.0-alpha.0",
            "v0.9.3",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.9.0-alpha.1",
            "v0.8.0",
            "v0.9.0-alpha.0",
            "v0.8.0-alpha.2",
            "v0.8.0-alpha.1",
            "v0.8.0-alpha.0",
            "v0.7.0",
            "v0.7.0-alpha.2",
            "v0.6.1",
            "v0.7.0-alpha.5",
            "v0.7.0-alpha.4",
            "v0.7.0-alpha.3",
            "v0.7.0-alpha.1",
            "v0.7.0-alpha.0",
            "v0.6.1-alpha.0",
            "v0.6.0",
            "v0.5.1-alpha.3",
            "v0.5.1-alpha.2",
            "v0.5.1-alpha.1",
            "v0.5.0",
            "v0.5.0-alpha.1",
            "v0.5.0-alpha.0",
            "v0.4.1",
            "v0.4.1-alpha.2",
            "v0.4.1-alpha.1",
            "v0.4.0",
            "v0.4.0-alpha.2",
            "v0.4.0-alpha.1",
            "v0.4.0-alpha.0",
            "v0.3.0",
            "v0.3.0-alpha.4",
            "v0.3.0-alpha.0",
            "v0.3.0-alpha.3",
            "v0.3.0-alpha.2",
            "v0.3.0-alpha.1",
            "v0.2.0",
            "v0.1.0",
            "v0.1.0-alpha",
            "v0.0.4",
            "v0.0.3",
            "v0.0.2",
            "v0.0.1-alpha.6",
            "v0.0.1-alpha.5",
            "v0.0.1-alpha.4",
            "v0.0.1-alpha.3",
            "v0.0.1-alpha.2",
            "v0.0.1-alpha.1",
            "v0.0.1-alpha.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7374.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.893353369Z",
      "provider": "osv",
      "references": [
        "https://catalog.redhat.com/software/containers/",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json",
        "https://access.redhat.com/errata/RHSA-2026:20720",
        "https://access.redhat.com/errata/RHSA-2026:20736",
        "https://access.redhat.com/errata/RHSA-2026:20763",
        "https://access.redhat.com/errata/RHSA-2026:20767",
        "https://access.redhat.com/errata/RHSA-2026:20782",
        "https://access.redhat.com/errata/RHSA-2026:20825",
        "https://access.redhat.com/errata/RHSA-2026:20866",
        "https://access.redhat.com/errata/RHSA-2026:20886",
        "https://access.redhat.com/errata/RHSA-2026:20890",
        "https://access.redhat.com/errata/RHSA-2026:20975",
        "https://access.redhat.com/security/cve/CVE-2026-7374",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7374.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-7374",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2463728",
        "https://github.com/kubevirt/kubevirt"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-59"
        ],
        "cna_assigner": "redhat",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "1779375376"
                  },
                  {
                    "fixed": "1778999881"
                  },
                  {
                    "fixed": "1779321599"
                  },
                  {
                    "fixed": "1778859977"
                  },
                  {
                    "fixed": "1778861274"
                  },
                  {
                    "fixed": "1779174925"
                  },
                  {
                    "fixed": "1778887155"
                  },
                  {
                    "fixed": "1779289071"
                  },
                  {
                    "fixed": "1779288737"
                  },
                  {
                    "fixed": "1779420069"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "InverseAffectedRanges"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7374.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-7374",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517031,
  "published_at": "2026-05-26T13:14:53.851+00:00"
}