CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
An attacker in a virt-launcher pod can hijack virt-handler sockets via symlink following, causing VM state corruption and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13201?
CVE-2026-13201 is a high-severity path traversal vulnerability in Red Hat Container Native Virtualization 4.12, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.
Weakness: CWE-61
Which versions are affected by CVE-2026-13201?
It affects 2 products.
Products include Kubevirt Kubevirt, Redhat Openshift Virtualization.
How do I fix CVE-2026-13201?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-13201 being exploited?
There is no known exploitation of CVE-2026-13201 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Container Native Virtualization 4.12
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
Sources
Also known as AZL-91173, GHSA-rcfc-7m3g-h5xh, MINI-5v23-v4r7-4qrp, MINI-j6mw-wjm3-mw8v.