CVE-2026-7374Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Timeline

Scores

EPSS (exploitation in 30 days)

0.74% · top 45% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.

Affected products

• kubevirt

  • affected < 1.6.6
  • affected 1.7.0 – < 1.7.4
  • affected 1.8.0 – < 1.8.3

• Red Hat · Red Hat Container Native Virtualization 4.12

  • unaffected 1779375376 – < *

• Red Hat · Red Hat Container Native Virtualization 4.13

  • unaffected 1778999881 – < *

• Red Hat · Red Hat Container Native Virtualization 4.14

  • unaffected 1779321599 – < *

• Red Hat · Red Hat Container Native Virtualization 4.15

  • unaffected 1778859977 – < *

• Red Hat · Red Hat Container Native Virtualization 4.16

  • unaffected 1778861274 – < *

• Red Hat · Red Hat Container Native Virtualization 4.17

  • unaffected 1779174925 – < *

• Red Hat · Red Hat Container Native Virtualization 4.18

  • unaffected 1778887155 – < *

• Red Hat · Red Hat Container Native Virtualization 4.19

  • unaffected 1779289071 – < *

• Red Hat · Red Hat Container Native Virtualization 4.20

  • unaffected 1779288737 – < *

• Red Hat · Red Hat Container Native Virtualization 4.21

  • unaffected 1779420069 – < *

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gokubevirt.io/kubevirtGHSA-7jcp-v9w4-wjmg (opens in a new tab)

What to do

Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-31824 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7jcp-v9w4-wjmg (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-7374](https://cveledger.app/badge/CVE-2026-7374.svg)](https://cveledger.app/cve/CVE-2026-7374)

Record last updated 10 Sept 2026, 12:05 UTC.