CVE-2026-13622
NVD analysis in progress
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
What this means
- Exposure
- Exploitable with local access to the machine, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- An attacker-supplied file path is not confined, letting them read or write outside the intended folder.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.