CVE-2026-13201

Full vulnerability record from the local CVENow database.
Description

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.
Severity
HIGH
CVSS score
7.3 (v3.1)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2026-06-24 21:16:52.420000
Last modified
2026-10-25 22:10:00.150000
View original CVE JSON
{
  "id": "CVE-2026-13201",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T21:16:52.420",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el paquete safepath de KubeVirt utilizado por virt-handler. La función OpenAtNoFollow utiliza O_PATH|O_NOFOLLOW para obtener un descriptor de archivo a un elemento final de la ruta, pero las operaciones posteriores resuelven la ruta a través de /proc/self/fd/N utilizando llamadas al sistema de seguimiento de enlaces. Cuando el elemento final es un enlace simbólico, el kernel lo desreferencia, anulando la protección no-follow prevista. Un atacante con acceso a un pod virt-launcher puede explotar esto para redirigir las conexiones de socket IPC de virt-handler, incluyendo el socket de notificación utilizado para eventos del ciclo de vida del dominio de la VM. Al secuestrar este socket, el atacante puede inyectar eventos de dominio arbitrarios en virt-handler, haciendo que tome acciones de ciclo de vida incorrectas, corrompa el estado de la VM en la API de Kubernetes, o se bloquee - lo que resulta en una denegación sostenida de los servicios de gestión de VM para todas las máquinas virtuales en el nodo afectado. Además, la misma falla de seguimiento de enlaces simbólicos permite a virt-handler aplicar cambios de propiedad o permisos de archivo a rutas de host no deseadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.12",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.12::el8"
          ],
          "versions": [
            {
              "version": "1791522624",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.13",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.13::el9"
          ],
          "versions": [
            {
              "version": "1786346596",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.14",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.14::el9"
          ],
          "versions": [
            {
              "version": "1786309624",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.15",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.15::el9"
          ],
          "versions": [
            {
              "version": "1786347656",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.16::el9"
          ],
          "versions": [
            {
              "version": "1786030071",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.17::el9"
          ],
          "versions": [
            {
              "version": "1786348529",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.18",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.18::el9"
          ],
          "versions": [
            {
              "version": "1786130068",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.19",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.19::el9"
          ],
          "versions": [
            {
              "version": "1786334215",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.20",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.20::el9"
          ],
          "versions": [
            {
              "version": "1785831334",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.21",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.21::el9"
          ],
          "versions": [
            {
              "version": "1785829701",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.22",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.22::el9"
          ],
          "versions": [
            {
              "version": "1785140336",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T23:04:34.331359Z",
          "id": "CVE-2026-13201",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*",
              "matchCriteriaId": "06AF9668-6158-47F4-A755-0EE4D5F7F413"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4",
              "versionEndIncluding": "4.22.0",
              "matchCriteriaId": "5301905C-9B5C-479F-A69A-659C6CB3AA42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:51031",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53655",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53671",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53684",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53721",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53728",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53763",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53797",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53826",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53838",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:80941",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-13201",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}