CVE-2026-6383
RBAC Authorization Bypass in KubeVirt Causes Unauthorized Access
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kubevirt | kubevirt | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in KubeVirt's RBAC evaluation logic can lead to unauthorized access to subresources, potentially disclosing sensitive information or allowing unauthorized actions. Such unauthorized access and potential data disclosure can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.
Additionally, the improper enforcement of fine-grained access controls may result in failure to meet regulatory requirements for data confidentiality and integrity, increasing the risk of non-compliance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper RBAC evaluation in KubeVirt due to truncation of subresource names, which affects permission checks on granular subresources.
To detect this vulnerability on your system, you should review RBAC policies and audit logs for unexpected access to subresources such as "vnc/screenshot" or "sev/*" that might be incorrectly granted or denied.
Specifically, you can use Kubernetes commands to inspect roles and role bindings related to KubeVirt subresources and monitor access attempts:
- kubectl get roles,rolebindings --all-namespaces -o yaml | grep -E 'vnc|sev'
- kubectl auth can-i --as <user> get vnc/screenshot
- kubectl auth can-i --as <user> get sev/<subresource>
Additionally, auditing Kubernetes API server logs for authorization failures or unexpected successes on these subresources can help identify exploitation or misconfigurations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should immediately review and tighten RBAC policies related to KubeVirt subresources to ensure that permissions are explicitly defined for granular subresources rather than relying on parent resource permissions.
Limit the assignment of custom roles that include permissions on affected subresources to only trusted users.
Monitor and audit access to subresources closely to detect any unauthorized access attempts.
Apply any patches or updates provided by KubeVirt or your Linux distribution vendor that address this RBAC evaluation flaw as soon as they become available.
Can you explain this vulnerability to me?
CVE-2026-6383 is a security flaw in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The issue occurs because the authorization mechanism improperly truncates subresource names during permission checks. For example, requests targeting detailed subresources like "vnc/screenshot" or "sev/*" are incorrectly evaluated against the permissions of their parent resources such as "vnc" or "sev". This leads to incorrect permission evaluations where fine-grained access controls are not properly enforced.
As a result, two main problems arise: legitimate users may be denied access to subresources they should be able to access, and authenticated users with certain custom roles may gain unauthorized access to subresources they should not have permission to use.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing authenticated users with specific custom roles to gain unauthorized access to sensitive subresources within KubeVirt. This unauthorized access could lead to disclosure of sensitive information or performing actions that the user is not permitted to do.
Additionally, legitimate users might be denied access to subresources they are authorized to use, potentially disrupting normal operations or workflows.