CVE-2026-13318

{"id": "CVE-2026-13318", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13318", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T12:35:22.451050Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Virtualization 4", "packageName": "container-native-virtualization/virt-api", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Virtualization 4", "packageName": "container-native-virtualization/virt-api-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-26T00:16:51.277", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-13318", "tags": ["Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492659", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation."}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) fue encontrada en el gestor de reenv\u00edo de puertos de la API virt de KubeVirt. Al procesar una petici\u00f3n de reenv\u00edo de puertos a una instancia de m\u00e1quina virtual (VMI), la API virt lee la direcci\u00f3n IP de destino de vmi.Status.Interfaces[0].IP y la pasa directamente a net.Dial() sin validaci\u00f3n. Para las VMI que utilizan enlaces de red sin enmascaramiento (puente o solo secundario), esta direcci\u00f3n IP es reportada por el agente invitado QEMU que se ejecuta dentro de la VM y es totalmente controlable por el propietario de la VM. Un atacante con permisos kubevirt.io:edit puede crear una VM con un agente invitado modificado que reporta una direcci\u00f3n IP arbitraria, luego solicitar el reenv\u00edo de puertos para establecer un t\u00fanel TCP bidireccional desde la posici\u00f3n de red interna del cl\u00faster de la API virt a cualquier destino enrutable, eludiendo el aislamiento de NetworkPolicy."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*", "vulnerable": true, "matchCriteriaId": "06AF9668-6158-47F4-A755-0EE4D5F7F413"}, {"criteria": "cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5301905C-9B5C-479F-A69A-659C6CB3AA42", "versionEndIncluding": "4.22.0", "versionStartIncluding": "4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}