Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
Affects qemu-guest-agent in QEMU/KVM guests when a management layer such as libvirt triggers guest-ssh-add-authorized-keys for a local user whose home directory is attacker-owned. Fixed in qemu-kvm 10.1.0-17.el9_8.9 for RHEL 9.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 10.1.0-17.el9_8.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- qemu-kvm
Version range not reported
- qemu-kvm
Version range not reported
- qemu-kvm
Version range not reported
- qemu-kvm
Version range not reported
- qemu-kvm-ma
Version range not reported
- virt:rhel/qemu-kvm
Version range not reported
- qemu-kvm
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
References 5
access.redhat.com
bugzilla.redhat.com
gitlab.com
GitHub · M8seven/cve-2026-12080-qemu-guest-agent-authorized-keys
Questions about CVE-2026-12080
What does this mean?
The guest-ssh-add-authorized-keys command in qemu-guest-agent can be abused through a symlink in a user's home directory, so that root-owned files or directories change ownership. That can lead to root access on the guest. The bug needs a key-add to be triggered for a local user whose home directory the attacker controls.Source: access.redhat.com, bugzilla.redhat.com, access.redhat.com
Am I affected, and how do I check?
Red Hat's advisory lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10, plus several OpenShift Container Platform and RHEL for NVIDIA entries, as affected products. The code path needs an external management layer such as libvirt to trigger the key-add operation. To check a system, look at the installed qemu-guest-agent package version, for example with rpm -q qemu-guest-agent.Source: access.redhat.com, bugzilla.redhat.com, access.redhat.com
What should I do about it?
Upgrade to qemu-kvm 10.1.0-17.el9_8.9 on RHEL 9, which is the fixed version listed in the advisory. If the upgrade cannot be applied yet, block the command with qemu-ga --block-rpcs guest-ssh-add-authorized-keys.Source: access.redhat.com, bugzilla.redhat.com, access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data