CVE-2026-13622

{"id": "CVE-2026-13622", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13622", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T19:21:32.127174Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:container_native_virtualization:4.12::el8"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.12", "versions": [{"status": "unaffected", "version": "1785837722", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.13", "versions": [{"status": "unaffected", "version": "1786346596", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.14", "versions": [{"status": "unaffected", "version": "1786309624", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.15", "versions": [{"status": "unaffected", "version": "1786347656", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.16", "versions": [{"status": "unaffected", "version": "1786030071", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.17", "versions": [{"status": "unaffected", "version": "1786348529", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.18", "versions": [{"status": "unaffected", "version": "1786130068", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.19", "versions": [{"status": "unaffected", "version": "1786334215", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.20", "versions": [{"status": "unaffected", "version": "1785831334", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.21", "versions": [{"status": "unaffected", "version": "1785829701", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat Container Native Virtualization 4.22", "versions": [{"status": "unaffected", "version": "1785140336", "lessThan": "*", "versionType": "rpm"}], "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-12T21:17:35.630", "references": [{"url": "https://access.redhat.com/errata/RHEA-2026:53670", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:51031", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53655", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53671", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53684", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53721", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53728", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53763", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53797", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53826", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53838", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-13622", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494142", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de seguimiento de enlaces simb\u00f3licos en el proxy de migraci\u00f3n virt-handler de KubeVirt. Durante la migraci\u00f3n en vivo, virt-handler se conecta a sockets Unix dentro del pod virt-launcher de destino a trav\u00e9s de rutas /proc/[pid]/root/ usando net.Dial() sin protecci\u00f3n contra enlaces simb\u00f3licos. Estas rutas de socket residen en directorios propiedad de qemu escribibles por el usuario virt-launcher. Un atacante con permisos de edici\u00f3n de namespace y pods/exec puede reemplazar un socket del proxy de migraci\u00f3n con un enlace simb\u00f3lico al socket CRI-O del host. Debido a que virt-handler se ejecuta como root en el namespace de montaje del host, los destinos de enlaces simb\u00f3licos absolutos se resuelven contra el sistema de archivos del host, y el proxy bidireccional io.Copy retransmite bytes controlados por el atacante al tiempo de ejecuci\u00f3n del contenedor, lo que permite el compromiso total del nodo."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "secalert@redhat.com"}