9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7374

CVE-2026-7374: Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7374

CVE-2026-7374:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kubevirt.io/kubevirt	go	>= 1.8.0-alpha.0, < 1.8.3	1.8.3
kubevirt.io/kubevirt	go	>= 1.7.0-alpha.0, < 1.7.4	1.7.4
kubevirt.io/kubevirt	go	< 1.6.6	1.6.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic link-following issue within the KubeVirt virt-handler component. An attacker with permissions to create/edit virtual machines could exploit this to gain control over the underlying node and potentially the entire cluster.

The root cause lies in how virt-handler connects to virtual machine console sockets. The process involved two key functions:

ConsoleHandler.getUnixSocketPath: This function constructed the path to the console socket file. Critically, it used os.Stat to validate the path. os.Stat follows symbolic links by default, meaning if an attacker replaced the legitimate socket with a symlink pointing to a sensitive host socket (like /var/run/crio/crio.sock), this check would validate the existence of the target file, not the symlink itself.
unixSocketDialer: This function took the path from getUnixSocketPath and used net.Dial("unix", ...) to establish a connection. net.Dial also follows symlinks. Therefore, it would connect to the malicious target specified by the attacker's symlink, but with the high privileges of the virt-handler process.

The patch addresses this by introducing the safepath library. The getUnixSocketPath function was modified to use safepath.AppendAndResolveWithRelativeRoot, which resolves a path without following symlinks. The unixSocketDialer was changed to use safepath.ExecuteNoFollow, ensuring that the dial operation is performed on the legitimate file and not a symlink target. This prevents the symlink from being followed at the time of connection, mitigating the vulnerability.

Vulnerable functions

ConsoleHandler.getUnixSocketPath

pkg/virt-handler/rest/console.go

This function constructs the path to the Unix socket for the virtual machine console. The vulnerable version of this function used `path.Join` to construct the path and `os.Stat` to check for its existence. `os.Stat` follows symbolic links, so an attacker could replace the socket file with a symlink to a sensitive socket on the host (e.g., the CRI-O socket), and this function would not detect the malicious symlink.

unixSocketDialer

pkg/virt-handler/rest/console.go

This function is responsible for creating a connection to the Unix socket. The vulnerable version used `net.Dial` with the file path returned by `getUnixSocketPath`. If this path was a symlink to another socket, `net.Dial` would follow the symlink and connect to the target socket with the privileges of the `virt-handler` process. This allowed an attacker to hijack the connection and interact with privileged sockets on the host.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.