CVE-2026-13318

{
  "id": "CVE-2026-13318",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T00:16:51.277",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) fue encontrada en el gestor de reenvío de puertos de la API virt de KubeVirt. Al procesar una petición de reenvío de puertos a una instancia de máquina virtual (VMI), la API virt lee la dirección IP de destino de vmi.Status.Interfaces[0].IP y la pasa directamente a net.Dial() sin validación. Para las VMI que utilizan enlaces de red sin enmascaramiento (puente o solo secundario), esta dirección IP es reportada por el agente invitado QEMU que se ejecuta dentro de la VM y es totalmente controlable por el propietario de la VM. Un atacante con permisos kubevirt.io:edit puede crear una VM con un agente invitado modificado que reporta una dirección IP arbitraria, luego solicitar el reenvío de puertos para establecer un túnel TCP bidireccional desde la posición de red interna del clúster de la API virt a cualquier destino enrutable, eludiendo el aislamiento de NetworkPolicy."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Virtualization 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "container-native-virtualization/virt-api",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Virtualization 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "container-native-virtualization/virt-api-rhel9",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T12:35:22.451050Z",
          "id": "CVE-2026-13318",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*",
              "matchCriteriaId": "06AF9668-6158-47F4-A755-0EE4D5F7F413"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4",
              "versionEndIncluding": "4.22.0",
              "matchCriteriaId": "5301905C-9B5C-479F-A69A-659C6CB3AA42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-13318",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492659",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}