CVE-2026-7374: Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-09-10
Weakness: CWE-59

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Affected products

Red Hat Container Native Virtualization 4.12: all versions — fixed in 1779375376
Red Hat Container Native Virtualization 4.13: all versions — fixed in 1778999881
Red Hat Container Native Virtualization 4.14: all versions — fixed in 1779321599
Red Hat Container Native Virtualization 4.15: all versions — fixed in 1778859977
Red Hat Container Native Virtualization 4.16: all versions — fixed in 1778861274
Red Hat Container Native Virtualization 4.17: all versions — fixed in 1779174925
Red Hat Container Native Virtualization 4.18: all versions — fixed in 1778887155
Red Hat Container Native Virtualization 4.19: all versions — fixed in 1779289071
Red Hat Container Native Virtualization 4.20: all versions — fixed in 1779288737
Red Hat Container Native Virtualization 4.21: all versions — fixed in 1779420069

How to fix

Upgrade to a fixed version: Red Hat Container Native Virtualization 4.12 1779375376; Red Hat Container Native Virtualization 4.13 1778999881; Red Hat Container Native Virtualization 4.14 1779321599; Red Hat Container Native Virtualization 4.15 1778859977; Red Hat Container Native Virtualization 4.16 1778861274; Red Hat Container Native Virtualization 4.17 1779174925; Red Hat Container Native Virtualization 4.18 1778887155; Red Hat Container Native Virtualization 4.19 1779289071; Red Hat Container Native Virtualization 4.20 1779288737; Red Hat Container Native Virtualization 4.21 1779420069. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-7374 or the next vulnerability affects your stack