CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Kubevirt — security advisories

8 advisorieslatest 2026-08-06⚡ RSS feed

Tracked Kubevirt products:

Kubevirt virt-handler containerized-data-importer

⚡ Watch Kubevirt

Get an email when a new Kubevirt advisory drops — max one per day, one-click unsubscribe.

CVE-2026-9804: Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

highCVSS 7.7CVE-2026-9804msrc2026-08-06

CVE-2025-64436: KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

mediumCVSS 5.3CVE-2025-64436msrc2026-08-06

CVE-2026-17527: Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

highCVSS 7.7CVE-2026-17527msrc2026-08-06

CVE-2026-13322: Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service

lowCVSS 3.8CVE-2026-13322msrc2026-06-09

CVE-2026-13201: Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

mediumCVSS 6.3CVE-2026-13201msrc2026-06-09

CVE-2026-13208: Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body

mediumCVSS 6.5CVE-2026-13208msrc2026-06-09

CVE-2026-13218: Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

mediumCVSS 4.2CVE-2026-13218msrc2026-06-09

CVE-2026-13325: Virt-handler-rhel9: kubevirt: kubevirt: disabletls migration setting removes authentication, exposing unauthenticated virtqemud proxy on all interfaces

highCVSS 8.5CVE-2026-13325msrc2026-06-09