CVE-2026-13434 | Medium | 4.9 | 2026-06-26 | A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied n… |
CVE-2026-13322 | Low | 3.8 | 2026-06-26 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input in… |
CVE-2026-13318 | Medium | 6.4 | 2026-06-26 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInst… |
CVE-2026-13218 | Medium | 4.2 | 2026-06-26 | A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and… |
CVE-2026-13208 | Medium | 6.5 | 2026-06-24 | A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace… |
CVE-2026-13201 | High | 7.3 | 2026-06-24 | A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path… |
CVE-2025-64324 | High | 7.7 | 2025-11-18 | KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user w… |
CVE-2025-64437 | Medium | 5.0 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock… |
CVE-2025-64436 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the… |
CVE-2025-64435 | Medium | 5.3 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the co… |
CVE-2025-64434 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCer… |
CVE-2025-64433 | Medium | 6.5 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary fil… |
CVE-2025-64432 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggrega… |
CVE-2024-33394 | Medium | 5.9 | 2024-05-02 | An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2023-26484 | High | 8.2 | 2023-03-15 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-h… |
CVE-2022-1798 | High | 8.7 | 2022-09-15 | A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary fil… |
CVE-2020-1701 | Medium | 6.5 | 2021-05-27 | A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create V… |
CVE-2020-14316 | Critical | 9.9 | 2020-07-29 | A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation al… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2019-3841 | High | 7.4 | 2019-03-25 | Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container… |