Symlink Following in KubeVirt Virt-Handler Migration Proxy

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Red Hat, Inc.

Description

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-13622

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	kubevirt	-

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a symlink following vulnerability in KubeVirt's virt-handler migration proxy. During live migration, virt-handler connects to Unix sockets in the target pod via /proc/<pid>/root/ paths without checking for symlinks. An attacker with specific permissions can replace a migration proxy socket with a symlink pointing to the host's CRI-O socket. Since virt-handler runs as root in the host mount namespace, the symlink resolves on the host filesystem, allowing the attacker to relay malicious data to the container runtime and potentially compromise the entire node.

Impact Analysis

If you use KubeVirt with live migration enabled, an attacker with namespace edit and pods/exec permissions could exploit this to gain full control over the Kubernetes node. This could lead to unauthorized access, data theft, or disruption of services running on the affected node.

Mitigation Strategies

Update KubeVirt to the latest version that patches the symlink following vulnerability in virt-handler. Restrict user permissions to prevent unauthorized access to writable directories and socket paths. Monitor for unusual activity in migration proxy sockets and container runtime communications.

Hi! I’m here to help you understand CVE-2026-13622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70