CVE-2026-7374 Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

What is CVE-2026-7374?

CVE-2026-7374 is a critical path traversal vulnerability in Red Hat Container Native Virtualization 4.12, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Weakness: CWE-59

Which versions are affected by CVE-2026-7374?

7 open source packages ship an affected version, including kubevirt.io/kubevirt.

How do I fix CVE-2026-7374?

Upgrade kubevirt.io/kubevirt to a fixed version for your release line: 1.6.6, 1.7.4 or 1.8.3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-7374 being exploited?

There is no known exploitation of CVE-2026-7374 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-89193, GHSA-7jcp-v9w4-wjmg, GO-2026-5848, MINI-7v9q-f4jr-h4hh, MINI-vf3v-w73q-hh5v, SUSE-SU-2026:2077-1.