CVE-2026-7374

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: May 26, 2026
Source updated: Sep 10, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

kubevirt

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: Unknown
Package: kubevirt
Package collection: https://github.com/kubevirt/kubevirt

kubevirt · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	semver	1.6.6	Unavailable	None listed
1.7.0	`affected`	semver	1.7.4	Unavailable	None listed
1.8.0	`affected`	semver	1.8.3	Unavailable	None listed

Red Hat Container Native Virtualization 4.12

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.12
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.12 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779375376	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.13

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.13
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.13 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1778999881	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.14

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.14
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.14 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779321599	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.15

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.15
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.15 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1778859977	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.16

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.16
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.16 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1778861274	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.17

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.17
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779174925	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.18

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.18
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.18 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1778887155	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.19

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.19
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.19 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779289071	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.20

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.20
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.20 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779288737	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Container Native Virtualization 4.21

Vendor: Red Hat
Product: Red Hat Container Native Virtualization 4.21
Platforms: Unknown
Default status: affected
Package: container-native-virtualization/virt-handler-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat Container Native Virtualization 4.21 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1779420069	`unaffected`	rpm	*	Unavailable	None listed