CVE-2026-13318: KubeVirt virt-api SSRF Vulnerability

CVE-2026-13318 Overview

CVE-2026-13318 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in KubeVirt's virt-api port-forward handler. The handler reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VirtualMachineInstances (VMIs) using non-masquerade network bindings, that IP is reported by the QEMU guest agent inside the VM and is controllable by the VM owner. An attacker holding kubevirt.io:edit permissions can pivot virt-api into establishing a bidirectional TCP tunnel to arbitrary cluster-internal or routable destinations, bypassing Kubernetes NetworkPolicy isolation.

Critical Impact
An authenticated tenant can weaponize the control-plane's network position to reach internal services that NetworkPolicy would otherwise block.

Affected Products

KubeVirt virt-api component
VMIs configured with bridge network binding
VMIs configured with secondary-only (non-masquerade) network bindings

Discovery Timeline

2026-06-26 - CVE-2026-13318 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-13318

Vulnerability Analysis

KubeVirt runs VMs as pods inside Kubernetes, with virt-api acting as the aggregated API server for VM operations. The port-forward subresource lets clients tunnel TCP connections to a VMI. To route the connection, virt-api looks up the VMI object and reads the first entry of vmi.Status.Interfaces for a target IP. That status field is populated by the QEMU guest agent running inside the VM.

Because the field crosses a trust boundary, a hostile guest can advertise any IP it wants. virt-api then dials that address on behalf of the requester. The resulting connection originates from virt-api's pod, which sits inside the control-plane network and is typically exempt from tenant NetworkPolicy rules.

Root Cause

The root cause is missing validation of tenant-controlled data before use in an outbound network call. The port-forward handler treats vmi.Status.Interfaces[0].IP as authoritative even though the guest agent, and therefore the VM owner, writes it. There is no allowlist restricting the IP to the pod CIDR of the corresponding VMI, and no check that the address belongs to the VM's own network namespace.

Attack Vector

An attacker with kubevirt.io:edit rights in any namespace creates a VMI using a bridge or secondary interface binding. Inside the VM, they run a modified QEMU guest agent that reports an arbitrary target IP, for example the address of the Kubernetes API server, an internal metadata service, or a database pod. The attacker then issues a virtctl port-forward request against the VMI. virt-api calls net.Dial() against the attacker-supplied IP and proxies traffic in both directions, giving the attacker a TCP tunnel that inherits virt-api's network identity.

No verified public exploit code is available. Technical detail on the flow is documented in the Red Hat CVE-2026-13318 advisory and Red Hat Bug Report #2492659.

Detection Methods for CVE-2026-13318

Indicators of Compromise

Outbound TCP connections from virt-api pods to destinations outside the tenant pod CIDR, especially to cluster-internal services, node IPs, or link-local metadata addresses.
VMIs whose status.interfaces[0].ip does not match any address assigned within the VM's pod network namespace.
Repeated port-forward subresource requests against VMIs owned by low-privilege service accounts holding kubevirt.io:edit.

Detection Strategies

Audit Kubernetes API server logs for pods/portforward and VMI portforward subresource calls, correlating requester identity with the target VMI's reported interface IP.
Compare vmi.Status.Interfaces[0].IP against the IPAM-assigned pod IP for the underlying virt-launcher pod, and alert on mismatches.
Baseline virt-api egress destinations, and flag any connection reaching sensitive endpoints such as the API server, etcd, cloud metadata, or database services.

Monitoring Recommendations

Ingest Kubernetes audit logs and container network flow telemetry into a centralized analytics platform for correlation between API activity and pod-level connections.
Enable KubeVirt virt-api verbose logging on port-forward operations to capture the destination IP passed to net.Dial().
Track creation of VMIs using non-masquerade bindings, and review the RBAC grants that permit kubevirt.io:edit on the corresponding namespaces.

How to Mitigate CVE-2026-13318

Immediate Actions Required

Upgrade KubeVirt to a fixed release once available from your distribution; consult the Red Hat CVE-2026-13318 advisory for the specific package versions.
Restrict kubevirt.io:edit and VMI creation rights to trusted principals only, and remove broad namespace bindings.
Prefer the masquerade network binding for VMIs, since masquerade IPs are managed by virt-launcher and are not guest-controlled.

Patch Information

Refer to the Red Hat CVE-2026-13318 advisory and Red Hat Bug Report #2492659 for fixed component versions. The fix validates that the port-forward destination IP belongs to the VMI's own pod network namespace before dialing.

Workarounds

Deny the pods/portforward and VMI portforward subresources for tenant service accounts using RBAC or an admission controller such as Kyverno or OPA Gatekeeper.
Apply a NetworkPolicy or CNI egress policy on virt-api pods restricting outbound traffic to the VMI pod CIDR only.
Disable or block bridge and secondary-only network bindings for untrusted tenants via a ValidatingAdmissionPolicy on VirtualMachineInstance objects.

bash

# Example Kyverno policy fragment: block port-forward for untrusted subjects
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-vmi-portforward
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-portforward-subresource
      match:
        any:
          - resources:
              kinds:
                - VirtualMachineInstance/portforward
      exclude:
        any:
          - subjects:
              - kind: Group
                name: system:cluster-admins
      validate:
        message: "VMI port-forward is disabled pending CVE-2026-13318 remediation."
        deny: {}