CVE-2026-13201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13201", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-24T13:58:29.925Z", "datePublished": "2026-06-24T20:39:00.173Z", "dateUpdated": "2026-10-12T20:47:23.283Z"}, "containers": {"cna": {"title": "Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.12", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler", "defaultStatus": "affected", "versions": [{"version": "1791522624", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.12::el8"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786346596", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786309624", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786347656", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786030071", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786348529", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786130068", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.19", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786334215", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.20", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1785831334", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.21", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1785829701", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.21::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.22", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "container-native-virtualization/virt-handler-rhel9", "defaultStatus": "affected", "versions": [{"version": "1785140336", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:container_native_virtualization:4.22::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:51031", "name": "RHSA-2026:51031", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53655", "name": "RHSA-2026:53655", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53671", "name": "RHSA-2026:53671", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53684", "name": "RHSA-2026:53684", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53721", "name": "RHSA-2026:53721", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53728", "name": "RHSA-2026:53728", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53763", "name": "RHSA-2026:53763", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53797", "name": "RHSA-2026:53797", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53826", "name": "RHSA-2026:53826", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53838", "name": "RHSA-2026:53838", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:80941", "name": "RHSA-2026:80941", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-13201", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203", "name": "RHBZ#2492203", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-06-24T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-61", "description": "UNIX Symbolic Link (Symlink) Following", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-61: UNIX Symbolic Link (Symlink) Following", "workarounds": [{"lang": "en", "value": "The following measures reduce the attacker pool and limit secondary impact:\n\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability."}], "timeline": [{"lang": "en", "time": "2026-06-24T13:52:04.691Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Huzaifa Sidhpurwala (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-12T20:47:23.283Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T23:04:34.331359Z", "id": "CVE-2026-13201", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T23:04:48.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T23:04:34.331359Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T23:04:41.471Z"}}], "cna": {"title": "Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption", "credits": [{"lang": "en", "value": "This issue was discovered by Huzaifa Sidhpurwala (Red Hat)."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:container_native_virtualization:4.12::el8"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.12", "versions": [{"status": "unaffected", "version": "1791522624", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.13", "versions": [{"status": "unaffected", "version": "1786346596", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.14", "versions": [{"status": "unaffected", "version": "1786309624", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.15", "versions": [{"status": "unaffected", "version": "1786347656", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.16", "versions": [{"status": "unaffected", "version": "1786030071", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.17", "versions": [{"status": "unaffected", "version": "1786348529", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.18", "versions": [{"status": "unaffected", "version": "1786130068", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.19", "versions": [{"status": "unaffected", "version": "1786334215", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.20", "versions": [{"status": "unaffected", "version": "1785831334", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.21", "versions": [{"status": "unaffected", "version": "1785829701", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.22", "versions": [{"status": "unaffected", "version": "1785140336", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-06-24T13:52:04.691Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-06-24T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:51031", "name": "RHSA-2026:51031", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53655", "name": "RHSA-2026:53655", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53671", "name": "RHSA-2026:53671", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53684", "name": "RHSA-2026:53684", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53721", "name": "RHSA-2026:53721", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53728", "name": "RHSA-2026:53728", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53763", "name": "RHSA-2026:53763", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53797", "name": "RHSA-2026:53797", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53826", "name": "RHSA-2026:53826", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53838", "name": "RHSA-2026:53838", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:80941", "name": "RHSA-2026:80941", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-13201", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203", "name": "RHBZ#2492203", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "The following measures reduce the attacker pool and limit secondary impact:\n\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "UNIX Symbolic Link (Symlink) Following"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-12T20:47:23.283Z"}, "x_redhatCweChain": "CWE-61: UNIX Symbolic Link (Symlink) Following"}}, "cveMetadata": {"cveId": "CVE-2026-13201", "state": "PUBLISHED", "dateUpdated": "2026-10-12T20:47:23.283Z", "dateReserved": "2026-06-24T13:58:29.925Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-06-24T20:39:00.173Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.12::el8"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler", "product": "Red Hat Container Native Virtualization 4.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791522624", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.13::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786346596", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.14::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786309624", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.15::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786347656", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.16::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786030071", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.17::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786348529", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.18::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786130068", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.19::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786334215", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.20::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1785831334", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.21::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1785829701", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:container_native_virtualization:4.22::el9"], "defaultStatus": "affected", "packageName": "container-native-virtualization/virt-handler-rhel9", "product": "Red Hat Container Native Virtualization 4.22", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1785140336", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "06AF9668-6158-47F4-A755-0EE4D5F7F413", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*", "matchCriteriaId": "5301905C-9B5C-479F-A69A-659C6CB3AA42", "versionEndIncluding": "4.22.0", "versionStartIncluding": "4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el paquete safepath de KubeVirt utilizado por virt-handler. La funci\u00f3n OpenAtNoFollow utiliza O_PATH|O_NOFOLLOW para obtener un descriptor de archivo a un elemento final de la ruta, pero las operaciones posteriores resuelven la ruta a trav\u00e9s de /proc/self/fd/N utilizando llamadas al sistema de seguimiento de enlaces. Cuando el elemento final es un enlace simb\u00f3lico, el kernel lo desreferencia, anulando la protecci\u00f3n no-follow prevista. Un atacante con acceso a un pod virt-launcher puede explotar esto para redirigir las conexiones de socket IPC de virt-handler, incluyendo el socket de notificaci\u00f3n utilizado para eventos del ciclo de vida del dominio de la VM. Al secuestrar este socket, el atacante puede inyectar eventos de dominio arbitrarios en virt-handler, haciendo que tome acciones de ciclo de vida incorrectas, corrompa el estado de la VM en la API de Kubernetes, o se bloquee - lo que resulta en una denegaci\u00f3n sostenida de los servicios de gesti\u00f3n de VM para todas las m\u00e1quinas virtuales en el nodo afectado. Adem\u00e1s, la misma falla de seguimiento de enlaces simb\u00f3licos permite a virt-handler aplicar cambios de propiedad o permisos de archivo a rutas de host no deseadas."}], "id": "CVE-2026-13201", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.7, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13201", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T23:04:34.331359Z", "version": "2.0.3"}}]}, "published": "2026-06-24T21:16:52.420", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:51031"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53655"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53671"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53684"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53721"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53728"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53763"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53797"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53826"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:53838"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:80941"}, {"source": "secalert@redhat.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-13201"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Huzaifa Sidhpurwala (Red Hat).", "bugzilla": {"description": "kubevirt: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification", "id": "2492203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-61", "details": ["A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream helpers operate via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to cause virt-handler to apply file ownership or permission changes to an unintended host path."], "mitigation": {"lang": "en:us", "value": "The following default configurations in OpenShift Virtualization significantly reduce exploitability and impact:\n1. Ensure SELinux is in enforcing mode (default in OpenShift). This restricts the set of host files that virt-handler can modify through this path, blocking operations on files with protected security labels.\n2. RHCOS immutable filesystem layers prevent modification of core OS files.\n3. Review RBAC policies to limit unnecessary pods/exec permissions on virt-launcher pods to reduce the attacker pool."}, "name": "CVE-2026-13201", "package_state": [{"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Fix deferred", "package_name": "container-native-virtualization/virt-handler", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Fix deferred", "package_name": "container-native-virtualization/virt-handler-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-13201\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-13201"], "statement": "A flaw was found in KubeVirt's safepath package where OpenAtNoFollow obtains a file descriptor to a leaf symlink using O_PATH|O_NOFOLLOW, then downstream helpers operate via /proc/self/fd/N which resolves through the symlink, defeating the intended no-follow protection. A namespace-level tenant with pod access can place a symlink in the virt-launcher filesystem, causing virt-handler (running as root on the node) to apply chown/chmod operations to an unintended host file. The direct impact is limited to blind modification of file ownership and permissions with hardcoded values \u2014 the attacker cannot read or write file contents and remains confined to the container. In default OpenShift Virtualization deployments, SELinux mandatory access controls restrict the set of host files that virt-handler can modify, and RHCOS immutable filesystem layers further reduce the attack surface.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "kubevirt", "vendor": "kubevirt"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "container_native_virtualization", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Virtualization 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_virtualization", "vendor": "redhat"}], "created": "2026-06-24T22:45:15.369485+00:00", "updated": "2026-06-26T09:40:21.370577+00:00", "vendors": ["kubevirt", "kubevirt$PRODUCT$kubevirt", "redhat", "redhat$PRODUCT$container_native_virtualization", "redhat$PRODUCT$openshift_virtualization"]}