CVE-2026-13218

Katalog CVE

CVSS 4.2 · Medium EPSS 0,14%

Kerentanan UNIX Symbolic Link (Symlink) Following pada kubevirt, redhat openshift virtualization. Skor CVSS 3.1 4.2 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-13218 advisory vendor · mitigasi
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654 issue tracking · advisory vendor