CVE-2026-13622 Overview
CVE-2026-13622 is a symlink following vulnerability in KubeVirt's virt-handler migration proxy. During live migration, virt-handler connects to Unix sockets inside the target virt-launcher pod using /proc/<pid>/root/ paths through net.Dial() without symlink protection. The socket paths reside in qemu-owned directories that are writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket, enabling full node compromise via the container runtime.
Critical Impact
An authenticated Kubernetes tenant with namespace edit and pods/exec permissions can pivot from a virt-launcher pod to full compromise of the underlying node by relaying traffic to the host CRI-O socket.
Affected Products
- KubeVirt virt-handler migration proxy component
- Kubernetes clusters running KubeVirt with live migration enabled
- Red Hat OpenShift Virtualization deployments referencing this advisory
Discovery Timeline
- 2026-08-12 - CVE-2026-13622 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13622
Vulnerability Analysis
The flaw is a classic symlink following weakness ([CWE-22]) inside KubeVirt's live migration data path. virt-handler runs as root in the host mount namespace and initiates outbound Unix socket connections to sockets that live inside a tenant-controlled pod. Because net.Dial() follows symlinks by default and there is no openat2 style resolution guard, the target of the dial is decided by whoever controls the filesystem entry at connection time.
Once connected, virt-handler runs a bidirectional io.Copy proxy between the migration source and the dialed socket. Any bytes the attacker can push through the migration proxy are relayed verbatim to whatever endpoint the symlink resolves to, including the host CRI-O socket. Speaking the CRI API as root permits container creation, host mount exposure, and node takeover.
Root Cause
The migration proxy trusts filesystem paths under /proc/<pid>/root/ that resolve inside virt-launcher pod directories owned by the unprivileged qemu user. The dialing code does not verify that the socket path is a real socket, does not restrict absolute symlink targets, and does not confine resolution to the container root. Absolute symlinks therefore escape the container view and resolve against the host filesystem.
Attack Vector
An attacker requires cluster access with edit on a namespace hosting a virtual machine and pods/exec on the virt-launcher pod. The attacker execs into the pod, deletes the expected migration proxy socket in the qemu-writable directory, and replaces it with a symlink pointing to /var/run/crio/crio.sock on the host. When a live migration is triggered, virt-handler dials the symlink, resolves it against the host mount namespace as root, and begins proxying attacker traffic to the container runtime API. The attacker then issues CRI requests to launch a privileged container with host filesystem mounts, achieving node compromise. Refer to the Red Hat CVE-2026-13622 Advisory and Red Hat Bug Report #2494142 for upstream technical detail.
Detection Methods for CVE-2026-13622
Indicators of Compromise
- Symlinks replacing expected Unix sockets inside virt-launcher pod directories, especially entries pointing to absolute host paths such as /var/run/crio/crio.sock.
- Unexpected CRI-O API activity correlated in time with a KubeVirt live migration event.
- New privileged containers or pods created outside the normal Kubernetes API path, appearing directly through the container runtime.
Detection Strategies
- Audit Kubernetes RBAC for principals that hold both namespace edit and pods/exec on namespaces running KubeVirt workloads.
- Monitor virt-handler process behavior for connections that resolve to host sockets rather than pod-scoped sockets.
- Alert on exec sessions into virt-launcher pods that perform unlink, ln -s, or socket manipulation within qemu-owned directories.
Monitoring Recommendations
- Ship Kubernetes audit logs and container runtime logs to a centralized analytics backend and correlate live migration events with CRI-O API calls.
- Track creation of containers on nodes that were not authorized through the Kubernetes API server as a signal of runtime-socket abuse.
- Enable file integrity monitoring on socket directories inside virt-launcher pods to catch symlink substitution.
How to Mitigate CVE-2026-13622
Immediate Actions Required
- Restrict pods/exec and namespace edit permissions on namespaces hosting KubeVirt virtual machines to a minimum set of trusted principals.
- Pause or disable live migration for tenant-controlled workloads until a patched virt-handler is deployed.
- Review the Red Hat CVE-2026-13622 Advisory for vendor-supplied patched builds and apply them to affected clusters.
Patch Information
Refer to the Red Hat CVE-2026-13622 Advisory and Red Hat Bug Report #2494142 for fixed component versions. Upstream remediation replaces the unchecked net.Dial() on /proc/<pid>/root/ paths with resolution that rejects symlinks and validates the target is a socket file owned by the expected process.
Workarounds
- Tighten RBAC so tenant users cannot obtain pods/exec against virt-launcher pods.
- Constrain the CRI-O socket with mandatory access controls such as SELinux so that only expected host processes may connect to it.
- Where feasible, isolate KubeVirt nodes hosting untrusted tenants so that node compromise does not expand blast radius to shared control plane services.
# Configuration example: restrict pods/exec via RBAC
# Deny exec on virt-launcher pods for non-admin roles
kubectl auth can-i create pods/exec --as=system:serviceaccount:tenant-a:default -n tenant-a
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
