CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
A compromised KubeVirt node allows attackers to modify node specs via the virt-handler service account, escalating privileges to access cluster secrets and other nodes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26484?
CVE-2023-26484 is a high-severity vulnerability in kubevirt, published on 15 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.
Weakness: CWE-863
Which versions are affected by CVE-2023-26484?
2 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions to 0.59.0 | None |
kubevirt.io/kubevirt Go | All versions to 0.59.0 | None |
Linux distribution packages (6)
kubevirt SUSE:Linux Enterprise Micro 5.3 | All versions | 0.54.0-150400.3.13.1 |
kubevirt SUSE:Linux Enterprise Micro 5.4 | All versions | 0.54.0-150400.3.13.1 |
kubevirt SUSE:Linux Enterprise Module for Containers 15 SP4 | All versions | 0.54.0-150400.3.13.1 |
kubevirt openSUSE:Leap 15.4 | All versions | 0.54.0-150400.3.13.1 |
kubevirt openSUSE:Leap Micro 5.3 | All versions | 0.54.0-150400.3.13.1 |
kubevirt openSUSE:Tumbleweed | All versions | 0.59.0-2.1 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2023-26484?
Apply a workaround.
Is CVE-2023-26484 being exploited?
There is no known exploitation of CVE-2023-26484 in the wild and no public exploit code.
Other vulnerabilities in kubevirt
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
- CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
Sources
Also known as AZL-25673, AZL-34902, GHSA-cp96-jpmq-xrr2, SUSE-SU-2023:1967-1, openSUSE-SU-2024:12792-1.