CVE-2026-6383: Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation
A flaw was found in KubeVirt's RBAC (Role-Based Access Control) evaluation logic. The authorization mechanism improperly truncates subresource names during evaluation. This causes requests for granular subresources, such as vnc/screenshot or sev/, to be incorrectly evaluated against their parent resource permissions (e.g., vnc or sev). As a result, the RBAC engine fails to enforce the intended granular access controls. This can cause legitimate users to be denied access or allow authenticated users with specific custom roles to gain unauthorized access to subresources.
Other sources
A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6383?
CVE-2026-6383 is classified as a high severity vulnerability due to its potential for unauthorized access in KubeVirt.
How do I fix CVE-2026-6383?
To remediate CVE-2026-6383, update KubeVirt to the latest version that addresses the improper RBAC evaluation.
What impact does CVE-2026-6383 have on my Kubernetes environment?
CVE-2026-6383 allows unauthorized users to access subresources, potentially compromising the security of your Kubernetes applications.
Is CVE-2026-6383 easy to exploit?
Yes, CVE-2026-6383 can be exploited by attackers who can authenticate to the KubeVirt API, making it relatively straightforward to exploit.
What are subresources in the context of CVE-2026-6383?
Subresources in KubeVirt refer to specific segments of resources that can have distinct permission requirements, such as logs or status.