CVE-2026-13208— KubeVirt 授权问题漏洞

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI's state and disrupt its lifecycle management.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

认证机制不恰当

KubeVirt 授权问题漏洞

KubeVirt是KubeVirt组织开源的一款用于在 Kubernetes 上直接运行和管理虚拟机的开源工具，让容器化应用和传统虚拟机工作负载可以在同一个平台上共存。 KubeVirt存在授权问题漏洞，该漏洞源于KubeVirt的virt-handler domain notify server中，gRPC处理程序直接从请求体派生VMI标识而不验证连接来源，允许被入侵的virt-launcher进程发送伪造的域生命周期事件来破坏其他VMI的状态管理。

N/A

N/A