CVE-2026-6383: Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

Published Apr 15, 2026
·
Updated

A flaw was found in KubeVirt's RBAC (Role-Based Access Control) evaluation logic. The authorization mechanism improperly truncates subresource names during evaluation. This causes requests for granular subresources, such as vnc/screenshot or sev/, to be incorrectly evaluated against their parent resource permissions (e.g., vnc or sev). As a result, the RBAC engine fails to enforce the intended granular access controls. This can cause legitimate users to be denied access or allow authenticated users with specific custom roles to gain unauthorized access to subresources.

Other sources

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

MITRE

Affected Software

2 affected components
Kubevirt KubeVirt
go/kubevirt.io/kubevirt<=1.8.1

Event History

Apr 15, 2026
Data Sourced
via Red Hat·06:08 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·06:22 PM
Data Sourced
via MITRE·06:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 PM
Data Sourced
via GitHub·09:30 PM
DescriptionSeverityWeaknessAffected Software
Nov 28, 58273
Event
via FIRST·07:05 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-6383?

CVE-2026-6383 is classified as a high severity vulnerability due to its potential for unauthorized access in KubeVirt.

2

How do I fix CVE-2026-6383?

To remediate CVE-2026-6383, update KubeVirt to the latest version that addresses the improper RBAC evaluation.

3

What impact does CVE-2026-6383 have on my Kubernetes environment?

CVE-2026-6383 allows unauthorized users to access subresources, potentially compromising the security of your Kubernetes applications.

4

Is CVE-2026-6383 easy to exploit?

Yes, CVE-2026-6383 can be exploited by attackers who can authenticate to the KubeVirt API, making it relatively straightforward to exploit.

5

What are subresources in the context of CVE-2026-6383?

Subresources in KubeVirt refer to specific segments of resources that can have distinct permission requirements, such as logs or status.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203