- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 20 · 1 critical, 4 high, 12 medium, 1 low
- Registry
- pkg.go.dev
Advisories 20
- CVE-2026-13322Low 3.8
Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
Affected: from 1.1.0-alpha.0.
- CVE-2026-13318Medium 6.4
Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
Affected: fixed in 1.10.0-rc.0.
- CVE-2026-13218Medium 4.2
Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
Affected: through 1.10.0-rc.0; all versions.
- CVE-2026-9804High 7.7
Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
Affected: all versions; through 1.9.0-beta.0.
- CVE-2026-7374Critical 9.9
Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability
Affected: from 1.8.0-alpha.0, fixed in 1.8.3; from 1.7.0-alpha.0, fixed in 1.7.4; fixed in 1.6.6; fixed in 1.6.6; from 1.7.0-alpha.0, fixed in 1.7.4; from 1.8.0-alpha.0, fixed in 1.8.3.
- CVE-2026-6383Medium 5.4
Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation
Affected: all versions; through 1.8.1.
- CVE-2025-14525Medium 6.4
Kubevirt: kubevirt: vm administration denial of service via guest agent
Affected: through 1.7.0; all versions.
- CVE-2025-64324High 8.5
KubeVirt Vulnerable to Arbitrary Host File Read and Write
Affected: fixed in 1.6.1; from 1.6.2, fixed in 1.7.0-rc.0; fixed in 1.6.1; from 1.7.0-alpha.0, fixed in 1.7.0-rc.0.
- CVE-2025-64433Medium 6.5
KubeVirt Arbitrary Container File Read
Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250801195231-a81b27d4600c; from 1.6.0-rc.0, fixed in 1.6.1.
- CVE-2025-64437Medium 5.0
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0.
- CVE-2025-64436Medium 6.9
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
Affected: fixed in 1.7.0.
- CVE-2025-64435Medium 5.3
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
Affected: fixed in 1.7.0-beta.0.
- CVE-2025-64434Medium 4.7
KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250730135146-231dc69723f3; from 1.6.0-rc.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1.
- CVE-2025-64432Medium 4.7
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; from 1.7.0-alpha.0, fixed in 1.7.0-rc.0; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250730135146-231dc69723f3; from 1.6.0-rc.0, fixed in 1.6.1; from 1.6.2, fixed in 1.7.0-rc.0.
- CVE-2024-33394Medium 5.9
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token…
Affected: through 1.2.0; all versions.
Show all 20 advisoriesShow fewer advisories
- CVE-2024-31420Medium 6.5
Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes
Affected: all versions; through 1.2.0.
- CVE-2023-26484High 8.2
On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
Affected: through 0.59.0.
- CVE-2022-1798High 8.7
Path Traversal vulnerability in Kubevirt
Affected: from 0.20.0, fixed in 0.55.1.
- CVE-2020-1701Unrated
A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler.
Affected: fixed in 0.26.0.
- CVE-2020-14316Unrated
A flaw was found in kubevirt 0.29 and earlier.
Affected: fixed in 0.30.0.