CVE-2026-13208
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
38/100
Published: 2026-06-24
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
None
I:
None
A:
High
Description
A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI's state and disrupt its lifecycle management.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| kubevirt | kubevirt | - |
| redhat | openshift_virtualization | 4 – 4.22.0 |
References & Advisories (2)
Mitigation
Vendor Advisory
Issue Tracking
Vendor Advisory