-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kubevirt.io/kubevirt | go | < 0.30.0 | 0.30.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing feature gate enforcement for hostDisk functionality. The fix in PR #3686 introduced a feature gate check (HostDisk) to restrict this capability. The validation function (ValidateVirtualMachineInstanceSpec) and hostDisk creation logic (createHostDisk) were vulnerable because they processed hostDisk volumes without checking if the feature was enabled. This allowed attackers to exploit VMIs to access the host filesystem. The link to the fix explicitly shows feature gate checks being added to these areas.
Ongoing coverage of React2Shell