--- id: CVE-2026-7374 title: A flaw was found in KubeVirt's virt-handler component summary: >- A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine consol… severity: critical cvss: 9.9 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H' cwe: - CWE-59 vendor: Red Hat product: kubevirt affected: - kubevirt < 1.6.6 - kubevirt >= 1.7.0 < 1.7.4 - kubevirt >= 1.8.0 < 1.8.3 - container-native-virtualization/virt-handler (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) - container-native-virtualization/virt-handler-rhel9 (all versions) patched: - container_native_virtualization 4.12 - container_native_virtualization 4.13 - container_native_virtualization 4.14 - container_native_virtualization 4.15 - container_native_virtualization 4.16 - container_native_virtualization 4.17 - container_native_virtualization 4.18 - container_native_virtualization 4.19 - container_native_virtualization 4.20 - container_native_virtualization 4.21 published: '2026-05-26' updated: '2026-09-10' sourceUpdated: '2026-09-10T13:20:31.720' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7374' references: - url: 'https://access.redhat.com/errata/RHSA-2026:20720' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20736' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20763' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20767' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20782' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20825' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20866' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20886' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20890' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20975' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-7374' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2463728' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:20720' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20736' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20763' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20767' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20782' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20825' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20866' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20886' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20890' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20975' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-7374' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2463728' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-7374' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7374' - url: 'https://github.com/kubevirt/kubevirt/pull/17916' - url: >- https://github.com/kubevirt/kubevirt/commit/011eef8129e2c21e0ea496f283ee1676009bc757 - url: 'https://github.com/kubevirt/kubevirt' tags: - nvd - cve.org - csaf - vex - red-hat - osv - go ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-05-26T00:00:00+00:00' epss: 0.00742 epssPercentile: 0.53239 ingestedAt: '2026-07-19T12:30:57.223Z' aliases: - GHSA-7jcp-v9w4-wjmg - GO-2026-5848 ecosystem: go --- ## Overview A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:20825** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.12 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20825) - **RHSA-2026:20886** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.13 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20886) - **RHSA-2026:20890** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.14 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20890) - **RHSA-2026:20866** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.15 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20866) - **RHSA-2026:20975** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.16 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20975) - **RHSA-2026:20763** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.17 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20763) - **RHSA-2026:20736** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.18 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20736) - **RHSA-2026:20767** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.19 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20767) - **RHSA-2026:20782** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.20 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20782) - **RHSA-2026:20720** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.21 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20720) ## Package advisory (CVE-2026-7374) Affected packages: - `kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3` - `kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4` - `kubevirt.io/kubevirt < 1.6.6` Patched in: - `kubevirt.io/kubevirt 1.8.3` - `kubevirt.io/kubevirt 1.7.4` - `kubevirt.io/kubevirt 1.6.6` Source: https://osv.dev/vulnerability/GHSA-7jcp-v9w4-wjmg