CVE-2026-6383

{
  "id": "CVE-2026-6383",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T19:16:38.520",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en la lógica de evaluación del Control de acceso basado en roles (RBAC) de KubeVirt. El mecanismo de autorización trunca de forma indebida los nombres de los subrecursos, lo que lleva a evaluaciones de permisos incorrectas. Esto permite a usuarios autenticados con roles personalizados específicos obtener acceso no autorizado a subrecursos, potencialmente revelando información sensible o realizando acciones para las que no tienen permiso. Además, a usuarios legítimos se les podría denegar el acceso a recursos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Virtualization 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "kubevirt",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T18:40:06.751506Z",
          "id": "CVE-2026-6383",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-6383",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458741",
      "source": "[email protected]"
    }
  ]
}