container native virtualization 4.16 Schwachstellen (CVE)

8.8Hoch

CVE-2026-13622 vor 2 Monaten

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.15

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These s…

7.7Hoch

CVE-2026-17527 vor 3 Monaten

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.16; Red Hat Red Hat Container Native Virtualization 4.17; Red Hat Red Hat Container Native Virtualization 4.18

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts t…

7.3Hoch

CVE-2026-13201 vor 4 Monaten

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14; Red Hat Red Hat Container Native Virtualization 4.15

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. …

9.9Kritisch

CVE-2026-7374 vor 5 Monaten

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

kubevirt; Red Hat Red Hat Container Native Virtualization 4.12; Red Hat Red Hat Container Native Virtualization 4.13; Red Hat Red Hat Container Native Virtualization 4.14

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacin…

8.7Hoch

CVE-2026-35469 vor 6 Monaten

SpdyStream: DOS on CRI

moby spdystream; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTING…

4.8Mittel

CVE-2026-40175 vor 7 Monaten

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

axios axios; Siemens gWAP; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Streams for Apache Kafka 3.2.0

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

2.0%EPSS

7.5Hoch

CVE-2026-32280 vor 7 Monaten

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

9.1Kritisch

CVE-2026-33186 vor 7 Monaten

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS

6.4Mittel

CVE-2025-57848 vor 1 Jahr

Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

Red Hat RHEL-8-CNV-4.12; Red Hat RHEL-9-CNV-4.14

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute c…