CVE-2026-13218

Published: Jun 26, 2026Modified: Jul 6, 2026

4.2

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

Exploitability: 1.1 / Impact: 2.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

Affected (2)

Products: Kubevirt: Kubevirt · Redhat: Openshift Virtualization

1 product

1 product

Openshift Virtualization

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kubevirt Kubevirt	All versions
Redhat Openshift Virtualization	From 4 to 4.22.0

Related CWEs

UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

References (2)

https://access.redhat.com/security/cve/CVE-2026-13218

Source: secalert@redhat.com

Vendor AdvisoryMitigation

https://bugzilla.redhat.com/show_bug.cgi?id=2492654

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.