What’s Vulnerable › Vulnerabilities

CVE-2026-6383: Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-15 · updated 2026-10-26
• Weakness: CWE-863

Description

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Affected products

• Red Hat OpenShift Virtualization 4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-6383
• https://bugzilla.redhat.com/show_bug.cgi?id=2458741

Get alerted when CVE-2026-6383 or the next vulnerability affects your stack