Skip to content
Fencer Intel
high 7.3

CVE-2026-13201 json

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

published 4mo ago modified 15d ago also EUVD-2026-39086

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Patch / fix

  • Red Hat Red Hat Container Native Virtualization 4.12 1791522624
  • Red Hat Red Hat Container Native Virtualization 4.13 1786346596
  • Red Hat Red Hat Container Native Virtualization 4.14 1786309624
  • Red Hat Red Hat Container Native Virtualization 4.15 1786347656
  • Red Hat Red Hat Container Native Virtualization 4.16 1786030071
  • Red Hat Red Hat Container Native Virtualization 4.17 1786348529
  • Red Hat Red Hat Container Native Virtualization 4.18 1786130068
  • Red Hat Red Hat Container Native Virtualization 4.19 1786334215
  • Red Hat Red Hat Container Native Virtualization 4.20 1785831334
  • Red Hat Red Hat Container Native Virtualization 4.21 1785829701
  • Red Hat Red Hat Container Native Virtualization 4.22 1785140336
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.17.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.33.1

suse advisories SUSE-SU-2026:3630-1SUSE-SU-2026:3480-1

  • kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
  • kubevirt1.9 openSUSE Tumbleweed 1.9.0-1.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.4-3.1

opensuse advisories openSUSE-SU-2026:21590-1openSUSE-SU-2026:11520-1openSUSE-SU-2026:11392-1

  • kubevirt Azure Linux 3.0 1.8.4-4

azure linux advisories AZL-91173

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-13201 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-13201 updated cvss 7.3

kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption

  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/virt-handler 1791522624
    fixed: vendor fix RHSA-2026:80941
  • Red Hat Container Native Virtualization 4.13 container-native-virtualization/virt-handler-rhel9 1786346596
    fixed: vendor fix RHSA-2026:53655
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-handler-rhel9 1786309624
    fixed: vendor fix RHSA-2026:53671
  • Red Hat Container Native Virtualization 4.15 container-native-virtualization/virt-handler-rhel9 1786347656
    fixed: vendor fix RHSA-2026:53826
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-handler-rhel9 1786030071
    fixed: vendor fix RHSA-2026:53721
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-handler-rhel9 1786348529
    fixed: vendor fix RHSA-2026:53684
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-handler-rhel9 1786130068
    fixed: vendor fix RHSA-2026:53838
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-handler-rhel9 1786334215
    fixed: vendor fix RHSA-2026:53797
show 4 more
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-handler-rhel9 1785831334
    fixed: vendor fix RHSA-2026:53763
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-handler-rhel9 1785829701
    fixed: vendor fix RHSA-2026:53728
  • Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-handler-rhel9 1785140336
    fixed: vendor fix RHSA-2026:51031
  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/virt-api 1791522806, container-native-virtualization/virt-launcher 1791522593, container-native-virtualization/virt-operator 1791522766, container-native-virtualization/virt-controller 1791522788, container-native-virtualization/libguestfs-tools 1791522741, container-native-virtualization/virt-exportproxy 1791522738, +2 more Red Hat Container Native Virtualization 4.13 container-native-virtualization/virt-api-rhel9 1786346580, container-native-virtualization/virt-launcher-rhel9 1786346603, container-native-virtualization/virt-operator-rhel9 1786346616, container-native-virtualization/virt-controller-rhel9 1786346582, container-native-virtualization/libguestfs-tools-rhel9 1786346781, container-native-virtualization/virt-exportproxy-rhel9 1786346580, +2 more Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-api-rhel9 1786309619, container-native-virtualization/pr-helper-rhel9 1786309619, container-native-virtualization/virt-launcher-rhel9 1786309632, container-native-virtualization/virt-operator-rhel9 1786309628, container-native-virtualization/virt-controller-rhel9 1786309611, container-native-virtualization/libguestfs-tools-rhel9 1786309926, +3 more Red Hat Container Native Virtualization 4.15 container-native-virtualization/virt-api-rhel9 1786347671, container-native-virtualization/pr-helper-rhel9 1786347643, container-native-virtualization/virt-launcher-rhel9 1786347665, container-native-virtualization/virt-operator-rhel9 1786347659, container-native-virtualization/virt-controller-rhel9 1786347653, container-native-virtualization/libguestfs-tools-rhel9 1786347853, +3 more Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-api-rhel9 1786030045, container-native-virtualization/pr-helper-rhel9 1786030078, container-native-virtualization/sidecar-shim-rhel9 1786030068, container-native-virtualization/virt-launcher-rhel9 1786030029, container-native-virtualization/virt-operator-rhel9 1786030038, container-native-virtualization/virt-controller-rhel9 1786030151, +6 more Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-api-rhel9 1786348516, container-native-virtualization/pr-helper-rhel9 1786348514, container-native-virtualization/sidecar-shim-rhel9 1786348511, container-native-virtualization/virt-launcher-rhel9 1786348550, container-native-virtualization/virt-operator-rhel9 1786348528, container-native-virtualization/virt-controller-rhel9 1786348515, +6 more
    +5 more products
    Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-api-rhel9 1786130057, container-native-virtualization/pr-helper-rhel9 1786130053, container-native-virtualization/sidecar-shim-rhel9 1786130064, container-native-virtualization/virt-launcher-rhel9 1786130096, container-native-virtualization/virt-operator-rhel9 1786130060, container-native-virtualization/virt-controller-rhel9 1786130051, +6 more Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-api-rhel9 1786334197, container-native-virtualization/pr-helper-rhel9 1786334208, container-native-virtualization/sidecar-shim-rhel9 1786334199, container-native-virtualization/virt-launcher-rhel9 1786334230, container-native-virtualization/virt-operator-rhel9 1786334196, container-native-virtualization/virt-controller-rhel9 1786334206, +6 more Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-api-rhel9 1785831215, container-native-virtualization/pr-helper-rhel9 1785832409, container-native-virtualization/sidecar-shim-rhel9 1785831732, container-native-virtualization/virt-launcher-rhel9 1785832905, container-native-virtualization/virt-operator-rhel9 1785831832, container-native-virtualization/virt-controller-rhel9 1785831119, +7 more Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-api-rhel9 1785829819, container-native-virtualization/pr-helper-rhel9 1785829747, container-native-virtualization/sidecar-shim-rhel9 1785829732, container-native-virtualization/virt-launcher-rhel9 1785829795, container-native-virtualization/virt-operator-rhel9 1785829903, container-native-virtualization/virt-controller-rhel9 1785829855, +7 more Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-api-rhel9 1785140353, container-native-virtualization/pr-helper-rhel9 1785140344, container-native-virtualization/sidecar-shim-rhel9 1785140344, container-native-virtualization/virt-launcher-rhel9 1785140380, container-native-virtualization/virt-operator-rhel9 1785140338, container-native-virtualization/virt-controller-rhel9 1785140344, +10 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4mo ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Affected products

  • Red Hat Red Hat Container Native Virtualization 4.12
  • Red Hat Red Hat Container Native Virtualization 4.13
  • Red Hat Red Hat Container Native Virtualization 4.14
  • Red Hat Red Hat Container Native Virtualization 4.15
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat Container Native Virtualization 4.22

Classification

Weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.