CVE-2026-7374: Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Other sources
A flaw was found in KubeVirt's virt-handler component. virt-handler connects to VM console sockets by following filesystem paths without validating symlinks. An authenticated OpenShift user with the standard edit role in a single namespace can exec into the virt-launcher pod, replace the console socket with a symlink pointing to the host's container runtime (CRI-O) socket, and hijack virt-handler's privileged connection. Since virt-handler runs with hostPID and elevated privileges, this allows the attacker to reach any unix socket on the host, potentially gaining full control of the node and cluster.
— Red Hat
Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7374?
CVE-2026-7374 has a critical severity rating of 9.9.
How do I fix CVE-2026-7374?
To fix CVE-2026-7374, update the KubeVirt virt-handler to the latest version that addresses this vulnerability.
What risks are associated with CVE-2026-7374?
CVE-2026-7374 allows for privilege escalation and potential node compromise by exploiting improper symlink validation.
Who is affected by CVE-2026-7374?
Authenticated OpenShift users with edit permissions in a single namespace are affected by CVE-2026-7374.
What component is vulnerable in CVE-2026-7374?
The vulnerability exists in the KubeVirt virt-handler component.