CVE-2026-13208 Auth bypass in Red Hat OpenShift Virtualization 4
A compromised virt-launcher can forge events for other VMIs on the same node, disrupting their lifecycle management due to missing identity validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13208?
CVE-2026-13208 is a medium-severity authentication bypass vulnerability in Red Hat OpenShift Virtualization 4, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI's state and disrupt its lifecycle management.
Weakness: CWE-287
Which versions are affected by CVE-2026-13208?
It affects 2 products.
Products include Kubevirt Kubevirt, Redhat Openshift Virtualization.
How do I fix CVE-2026-13208?
No fix has been published for CVE-2026-13208 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-13208 being exploited?
There is no known exploitation of CVE-2026-13208 in the wild and no public exploit code.
Other vulnerabilities in Red Hat OpenShift Virtualization 4
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
Sources
Also known as AZL-91460, GHSA-72r2-m3hg-cvf5, MINI-43p5-469p-jpqp, MINI-57w6-4j2p-vpw3.