CVE-2026-13201 (GCVE-0-2026-13201)

Vulnerability from cvelistv5 – Published: 2026-06-24 20:39 – Updated: 2026-08-11 18:48
VLAI
Title
Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption
Summary
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-25 23:04 UTC
CWE
  • CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
URL Tags
https://access.redhat.com/errata/RHSA-2026:51031 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53655 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53671 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53684 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53721 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53728 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53763 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53797 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53826 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53838 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-13201 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492203 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Container Native Virtualization 4.13 Unaffected: 1786346596 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.13::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.14 Unaffected: 1786309624 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.14::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.15 Unaffected: 1786347656 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.15::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.16 Unaffected: 1786030071 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.16::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.17 Unaffected: 1786348529 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.17::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.18 Unaffected: 1786130068 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.18::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.19 Unaffected: 1786334215 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.19::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.20 Unaffected: 1785831334 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.20::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.21 Unaffected: 1785829701 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.21::el9
 Create a notification for this product.
Red Hat Red Hat Container Native Virtualization 4.22 Unaffected: 1785140336 , < * (rpm)
    cpe:/a:redhat:container_native_virtualization:4.22::el9
 Create a notification for this product.
Red Hat Red Hat OpenShift Virtualization 4     cpe:/a:redhat:container_native_virtualization:4
 Create a notification for this product.
Date Public
2026-06-24 00:00
Credits
This issue was discovered by Huzaifa Sidhpurwala (Red Hat).
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T23:04:34.331359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T23:04:48.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786346596",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786309624",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786347656",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786030071",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786348529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786130068",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.19::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786334215",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.20::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.20",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785831334",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.21::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.21",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785829701",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler-rhel9",
          "product": "Red Hat Container Native Virtualization 4.22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785140336",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-handler",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Huzaifa Sidhpurwala (Red Hat)."
        }
      ],
      "datePublic": "2026-06-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in KubeVirt\u0027s safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler\u0027s IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T18:48:13.281Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:51031",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:51031"
        },
        {
          "name": "RHSA-2026:53655",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53655"
        },
        {
          "name": "RHSA-2026:53671",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53671"
        },
        {
          "name": "RHSA-2026:53684",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53684"
        },
        {
          "name": "RHSA-2026:53721",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53721"
        },
        {
          "name": "RHSA-2026:53728",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53728"
        },
        {
          "name": "RHSA-2026:53763",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53763"
        },
        {
          "name": "RHSA-2026:53797",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53797"
        },
        {
          "name": "RHSA-2026:53826",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53826"
        },
        {
          "name": "RHSA-2026:53838",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53838"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-13201"
        },
        {
          "name": "RHBZ#2492203",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492203"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-24T13:52:04.691Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following measures reduce the attacker pool and limit secondary impact:\n\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker\u0027s ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-61: UNIX Symbolic Link (Symlink) Following"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-13201",
    "datePublished": "2026-06-24T20:39:00.173Z",
    "dateReserved": "2026-06-24T13:58:29.925Z",
    "dateUpdated": "2026-08-11T18:48:13.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-13201",
      "date": "2026-08-14",
      "epss": "0.00147",
      "percentile": "0.04473"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:15:30.000Z",
      "cve": "CVE-2026-13201",
      "id": "msrc_CVE-2026-13201",
      "initial_release_date": "2026-06-27T01:05:21.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-13201.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-13201\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-06-24T21:16:52.420\",\"lastModified\":\"2026-08-11T19:17:19.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in KubeVirt\u0027s safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler\u0027s IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.13::el9\"],\"versions\":[{\"version\":\"1786346596\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.14::el9\"],\"versions\":[{\"version\":\"1786309624\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.15::el9\"],\"versions\":[{\"version\":\"1786347656\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.16::el9\"],\"versions\":[{\"version\":\"1786030071\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.17::el9\"],\"versions\":[{\"version\":\"1786348529\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.18::el9\"],\"versions\":[{\"version\":\"1786130068\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.19::el9\"],\"versions\":[{\"version\":\"1786334215\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.20::el9\"],\"versions\":[{\"version\":\"1785831334\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.21::el9\"],\"versions\":[{\"version\":\"1785829701\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-handler-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.22::el9\"],\"versions\":[{\"version\":\"1785140336\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/virt-handler\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-25T23:04:34.331359Z\",\"id\":\"CVE-2026-13201\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-61\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*\",\"matchCriteriaId\":\"06AF9668-6158-47F4-A755-0EE4D5F7F413\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4\",\"versionEndIncluding\":\"4.22.0\",\"matchCriteriaId\":\"5301905C-9B5C-479F-A69A-659C6CB3AA42\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:51031\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53655\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53671\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53684\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53721\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53728\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53763\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53797\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53826\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53838\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-13201\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2492203\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-11T18:48:10+00:00",
      "cve": "CVE-2026-13201",
      "id": "CVE-2026-13201",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:fixed": "25",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "296",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13201.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13201\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-25T23:04:34.331359Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-25T23:04:41.471Z\"}}], \"cna\": {\"title\": \"Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption\", \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Huzaifa Sidhpurwala (Red Hat).\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786346596\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786309624\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786347656\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786030071\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786348529\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786130068\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786334215\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785831334\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785829701\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1785140336\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"container-native-virtualization/virt-handler-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/virt-handler\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-24T13:52:04.691Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-24T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-06-24T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:51031\", \"name\": \"RHSA-2026:51031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53655\", \"name\": \"RHSA-2026:53655\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53671\", \"name\": \"RHSA-2026:53671\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53684\", \"name\": \"RHSA-2026:53684\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53721\", \"name\": \"RHSA-2026:53721\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53728\", \"name\": \"RHSA-2026:53728\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53763\", \"name\": \"RHSA-2026:53763\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53797\", \"name\": \"RHSA-2026:53797\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53826\", \"name\": \"RHSA-2026:53826\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53838\", \"name\": \"RHSA-2026:53838\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-13201\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2492203\", \"name\": \"RHBZ#2492203\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"The following measures reduce the attacker pool and limit secondary impact:\\n\\nReview RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem.\\nEnsure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels.\\nRHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path.\\nNote: no mitigation currently addresses the notify socket hijacking vector. The attacker\u0027s ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in KubeVirt\u0027s safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler\u0027s IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash \\u2014 resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-61\", \"description\": \"UNIX Symbolic Link (Symlink) Following\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-11T18:48:13.281Z\"}, \"x_redhatCweChain\": \"CWE-61: UNIX Symbolic Link (Symlink) Following\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-13201\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-11T18:48:13.281Z\", \"dateReserved\": \"2026-06-24T13:58:29.925Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-06-24T20:39:00.173Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.