Skip to content
Fencer Intel
high 8.8

CVE-2026-13622 json

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

published 2mo ago modified 17d ago also EUVD-2026-57615

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Patch / fix

  • Red Hat Red Hat Container Native Virtualization 4.12 1785837722
  • Red Hat Red Hat Container Native Virtualization 4.13 1786346596
  • Red Hat Red Hat Container Native Virtualization 4.14 1786309624
  • Red Hat Red Hat Container Native Virtualization 4.15 1786347656
  • Red Hat Red Hat Container Native Virtualization 4.16 1786030071
  • Red Hat Red Hat Container Native Virtualization 4.17 1786348529
  • Red Hat Red Hat Container Native Virtualization 4.18 1786130068
  • Red Hat Red Hat Container Native Virtualization 4.19 1786334215
  • Red Hat Red Hat Container Native Virtualization 4.20 1785831334
  • Red Hat Red Hat Container Native Virtualization 4.21 1785829701
  • Red Hat Red Hat Container Native Virtualization 4.22 1785140336
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.17.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.36.1

suse advisories SUSE-SU-2026:3630-1SUSE-SU-2026:3604-1

  • kubevirt1.9 openSUSE Leap 16.0 1.9.1-160000.1.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.4-6.1
  • kubevirt1.9 openSUSE Tumbleweed 1.9.0-3.1
  • kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1

opensuse advisories openSUSE-SU-2026:22180-1openSUSE-SU-2026:12227-1openSUSE-SU-2026:11752-1openSUSE-SU-2026:21590-1

  • kubevirt Azure Linux 3.0 1.8.4-4

azure linux advisories AZL-95943

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-13622 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-13622 updated cvss 8.8

kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/virt-handler 1785837722
    fixed: vendor fix RHEA-2026:53670
  • Red Hat Container Native Virtualization 4.13 container-native-virtualization/virt-handler-rhel9 1786346596
    fixed: vendor fix RHSA-2026:53655
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-handler-rhel9 1786309624
    fixed: vendor fix RHSA-2026:53671
  • Red Hat Container Native Virtualization 4.15 container-native-virtualization/virt-handler-rhel9 1786347656
    fixed: vendor fix RHSA-2026:53826
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-handler-rhel9 1786030071
    fixed: vendor fix RHSA-2026:53721
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-handler-rhel9 1786348529
    fixed: vendor fix RHSA-2026:53684
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-handler-rhel9 1786130068
    fixed: vendor fix RHSA-2026:53838
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-handler-rhel9 1786334215
    fixed: vendor fix RHSA-2026:53797
show 4 more
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-handler-rhel9 1785831334
    fixed: vendor fix RHSA-2026:53763
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-handler-rhel9 1785829701
    fixed: vendor fix RHSA-2026:53728
  • Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-handler-rhel9 1785140336
    fixed: vendor fix RHSA-2026:51031
  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/virt-api 1785837425, container-native-virtualization/virt-launcher 1785837377, container-native-virtualization/virt-operator 1785837645, container-native-virtualization/virt-controller 1785837409, container-native-virtualization/libguestfs-tools 1785837480, container-native-virtualization/virt-exportproxy 1785837298, +2 more Red Hat Container Native Virtualization 4.13 container-native-virtualization/virt-api-rhel9 1786346580, container-native-virtualization/virt-launcher-rhel9 1786346603, container-native-virtualization/virt-operator-rhel9 1786346616, container-native-virtualization/virt-controller-rhel9 1786346582, container-native-virtualization/libguestfs-tools-rhel9 1786346781, container-native-virtualization/virt-exportproxy-rhel9 1786346580, +2 more Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-api-rhel9 1786309619, container-native-virtualization/pr-helper-rhel9 1786309619, container-native-virtualization/virt-launcher-rhel9 1786309632, container-native-virtualization/virt-operator-rhel9 1786309628, container-native-virtualization/virt-controller-rhel9 1786309611, container-native-virtualization/libguestfs-tools-rhel9 1786309926, +3 more Red Hat Container Native Virtualization 4.15 container-native-virtualization/virt-api-rhel9 1786347671, container-native-virtualization/pr-helper-rhel9 1786347643, container-native-virtualization/virt-launcher-rhel9 1786347665, container-native-virtualization/virt-operator-rhel9 1786347659, container-native-virtualization/virt-controller-rhel9 1786347653, container-native-virtualization/libguestfs-tools-rhel9 1786347853, +3 more Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-api-rhel9 1786030045, container-native-virtualization/pr-helper-rhel9 1786030078, container-native-virtualization/sidecar-shim-rhel9 1786030068, container-native-virtualization/virt-launcher-rhel9 1786030029, container-native-virtualization/virt-operator-rhel9 1786030038, container-native-virtualization/virt-controller-rhel9 1786030151, +6 more Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-api-rhel9 1786348516, container-native-virtualization/pr-helper-rhel9 1786348514, container-native-virtualization/sidecar-shim-rhel9 1786348511, container-native-virtualization/virt-launcher-rhel9 1786348550, container-native-virtualization/virt-operator-rhel9 1786348528, container-native-virtualization/virt-controller-rhel9 1786348515, +6 more
    +5 more products
    Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-api-rhel9 1786130057, container-native-virtualization/pr-helper-rhel9 1786130053, container-native-virtualization/sidecar-shim-rhel9 1786130064, container-native-virtualization/virt-launcher-rhel9 1786130096, container-native-virtualization/virt-operator-rhel9 1786130060, container-native-virtualization/virt-controller-rhel9 1786130051, +6 more Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-api-rhel9 1786334197, container-native-virtualization/pr-helper-rhel9 1786334208, container-native-virtualization/sidecar-shim-rhel9 1786334199, container-native-virtualization/virt-launcher-rhel9 1786334230, container-native-virtualization/virt-operator-rhel9 1786334196, container-native-virtualization/virt-controller-rhel9 1786334206, +6 more Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-api-rhel9 1785831215, container-native-virtualization/pr-helper-rhel9 1785832409, container-native-virtualization/sidecar-shim-rhel9 1785831732, container-native-virtualization/virt-launcher-rhel9 1785832905, container-native-virtualization/virt-operator-rhel9 1785831832, container-native-virtualization/virt-controller-rhel9 1785831119, +7 more Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-api-rhel9 1785829819, container-native-virtualization/pr-helper-rhel9 1785829747, container-native-virtualization/sidecar-shim-rhel9 1785829732, container-native-virtualization/virt-launcher-rhel9 1785829795, container-native-virtualization/virt-operator-rhel9 1785829903, container-native-virtualization/virt-controller-rhel9 1785829855, +7 more Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-api-rhel9 1785140353, container-native-virtualization/pr-helper-rhel9 1785140344, container-native-virtualization/sidecar-shim-rhel9 1785140344, container-native-virtualization/virt-launcher-rhel9 1785140380, container-native-virtualization/virt-operator-rhel9 1785140338, container-native-virtualization/virt-controller-rhel9 1785140344, +10 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Container Native Virtualization 4.12
  • Red Hat Red Hat Container Native Virtualization 4.13
  • Red Hat Red Hat Container Native Virtualization 4.14
  • Red Hat Red Hat Container Native Virtualization 4.15
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat Container Native Virtualization 4.22

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.