# kubevirt.io/kubevirt (Go) vulnerabilities 20 known vulnerabilities (1 critical, 4 high, 12 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/kubevirt.io/kubevirt ## Advisories (20) ### [CVE-2026-13322](https://cve.now/CVE-2026-13322): Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service - Severity: Low 3.8 - Published: Jun 26, 2026 - Affected: from 1.1.0-alpha.0. ### [CVE-2026-13318](https://cve.now/CVE-2026-13318): Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip - Severity: Medium 6.4 - Published: Jun 25, 2026 - Affected: fixed in 1.10.0-rc.0. ### [CVE-2026-13218](https://cve.now/CVE-2026-13218): Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher - Severity: Medium 4.2 - Published: Jun 25, 2026 - Affected: through 1.10.0-rc.0; all versions. ### [CVE-2026-9804](https://cve.now/CVE-2026-9804): Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read - Severity: High 7.7 - Published: May 28, 2026 - Affected: all versions; through 1.9.0-beta.0. ### [CVE-2026-7374](https://cve.now/CVE-2026-7374): Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability - Severity: Critical 9.9 - Published: May 26, 2026 - Affected: from 1.8.0-alpha.0, fixed in 1.8.3; from 1.7.0-alpha.0, fixed in 1.7.4; fixed in 1.6.6; fixed in 1.6.6; from 1.7.0-alpha.0, fixed in 1.7.4; from 1.8.0-alpha.0, fixed in 1.8.3. ### [CVE-2026-6383](https://cve.now/CVE-2026-6383): Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation - Severity: Medium 5.4 - Published: Apr 15, 2026 - Affected: all versions; through 1.8.1. ### [CVE-2025-14525](https://cve.now/CVE-2025-14525): Kubevirt: kubevirt: vm administration denial of service via guest agent - Severity: Medium 6.4 - Published: Jan 26, 2026 - Affected: through 1.7.0; all versions. ### [CVE-2025-64324](https://cve.now/CVE-2025-64324): KubeVirt Vulnerable to Arbitrary Host File Read and Write - Severity: High 8.5 - Published: Nov 18, 2025 - Affected: fixed in 1.6.1; from 1.6.2, fixed in 1.7.0-rc.0; fixed in 1.6.1; from 1.7.0-alpha.0, fixed in 1.7.0-rc.0. ### [CVE-2025-64433](https://cve.now/CVE-2025-64433): KubeVirt Arbitrary Container File Read - Severity: Medium 6.5 - Published: Nov 7, 2025 - Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250801195231-a81b27d4600c; from 1.6.0-rc.0, fixed in 1.6.1. ### [CVE-2025-64437](https://cve.now/CVE-2025-64437): KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes - Severity: Medium 5.0 - Published: Nov 7, 2025 - Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0. ### [CVE-2025-64436](https://cve.now/CVE-2025-64436): KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes - Severity: Medium 6.9 - Published: Nov 7, 2025 - Affected: fixed in 1.7.0. ### [CVE-2025-64435](https://cve.now/CVE-2025-64435): KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation - Severity: Medium 5.3 - Published: Nov 7, 2025 - Affected: fixed in 1.7.0-beta.0. ### [CVE-2025-64434](https://cve.now/CVE-2025-64434): KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing - Severity: Medium 4.7 - Published: Nov 7, 2025 - Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250730135146-231dc69723f3; from 1.6.0-rc.0, fixed in 1.6.1; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1. ### [CVE-2025-64432](https://cve.now/CVE-2025-64432): KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer - Severity: Medium 4.7 - Published: Nov 7, 2025 - Affected: fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.1; from 1.7.0-alpha.0, fixed in 1.7.0-rc.0; fixed in 1.5.3; from 1.6.0-alpha.0, fixed in 1.6.0-beta.0.0.20250730135146-231dc69723f3; from 1.6.0-rc.0, fixed in 1.6.1; from 1.6.2, fixed in 1.7.0-rc.0. ### [CVE-2024-33394](https://cve.now/CVE-2024-33394): An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token… - Severity: Medium 5.9 - Published: May 2, 2024 - Affected: through 1.2.0; all versions. ### [CVE-2024-31420](https://cve.now/CVE-2024-31420): Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes - Severity: Medium 6.5 - Published: Apr 3, 2024 - Affected: all versions; through 1.2.0. ### [CVE-2023-26484](https://cve.now/CVE-2023-26484): On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs - Severity: High 8.2 - Published: Mar 15, 2023 - Affected: through 0.59.0. ### [CVE-2022-1798](https://cve.now/CVE-2022-1798): Path Traversal vulnerability in Kubevirt - Severity: High 8.7 - Published: Sep 15, 2022 - Affected: from 0.20.0, fixed in 0.55.1. ### [CVE-2020-1701](https://cve.now/CVE-2020-1701): A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. - Severity: Unrated - Published: May 27, 2021 - Affected: fixed in 0.26.0. ### [CVE-2020-14316](https://cve.now/CVE-2020-14316): A flaw was found in kubevirt 0.29 and earlier. - Severity: Unrated - Published: Jul 29, 2020 - Affected: fixed in 0.30.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/kubevirt.io/kubevirt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.