CVE-2026-6383

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-6383
https://bugzilla.redhat.com/show_bug.cgi?id=2458741

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en la lógica de evaluación del Control de acceso basado en roles (RBAC) de KubeVirt. El mecanismo de autorización trunca de forma indebida los nombres de los subrecursos, lo que lleva a evaluaciones de permisos incorrectas. Esto permite a usuarios autenticados con roles personalizados específicos obtener acceso no autorizado a subrecursos, potencialmente revelando información sensible o realizando acciones para las que no tienen permiso. Además, a usuarios legítimos se les podría denegar el acceso a recursos.

Information

Published : 2026-04-15 19:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-6383

Mitre link : CVE-2026-6383

CVE.ORG link : CVE-2026-6383

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-6383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6383", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:40:06.751506Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Virtualization 4", "packageName": "kubevirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-15T19:16:38.520", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-6383", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458741", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en la l\u00f3gica de evaluaci\u00f3n del Control de acceso basado en roles (RBAC) de KubeVirt. El mecanismo de autorizaci\u00f3n trunca de forma indebida los nombres de los subrecursos, lo que lleva a evaluaciones de permisos incorrectas. Esto permite a usuarios autenticados con roles personalizados espec\u00edficos obtener acceso no autorizado a subrecursos, potencialmente revelando informaci\u00f3n sensible o realizando acciones para las que no tienen permiso. Adem\u00e1s, a usuarios leg\u00edtimos se les podr\u00eda denegar el acceso a recursos."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "secalert@redhat.com"}