RedHat Openshift Virtualization vulnerabilities

11 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Exploited RedHat Openshift Virtualization vulnerabilities

CVE-2026-13434 — Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled (CVSS 4.9)
CVE-2026-13322 — Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service (CVSS 3.8)
CVE-2026-13318 — Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip (CVSS 6.4)
CVE-2026-13218 — Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher (CVSS 4.2)
CVE-2026-13208 — Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body (CVSS 6.5)
CVE-2026-13201 — Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption (CVSS 7.3)
CVE-2026-44495 — Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.7)
CVE-2023-48795 — (CVSS 5.9)
CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
CVE-2020-1742 — (CVSS 7.0)
CVE-2020-14316 — (CVSS 9.9)