CVE-2026-7374Critical· 9.9▾ MidnightA flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine consol…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
0.6% → 0.7%
Last analysed / modified upstream
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4kubevirt.io/kubevirt < 1.6.6Patched in:
kubevirt.io/kubevirt 1.8.3kubevirt.io/kubevirt 1.7.4kubevirt.io/kubevirt 1.6.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39819Medium· 4.4cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)
CVE-2026-79699Medium· 4.4A flaw was found in the containers/storage library
CVE-2026-17106High· 7.8github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)
CVE-2026-13201High· 7.3A flaw was found in KubeVirt's safepath package used by virt-handler
CVE-2026-53489Medium· 6.5github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore (CVE-2026-53489)
CVE-2026-19693High· 8.1extract-zip: extract-zip: Arbitrary file write via symlink in archive (CVE-2026-19693)