{"id":"CVE-2026-13218","revision":"b809542586bc4bf08b48402cb1964a02","records":[{"revision":"b809542586bc4bf08b48402cb1964a02","observedAt":"2026-11-04T18:05:55.7+00:00","statement":{"source":"nvd","id":"CVE-2026-13218","aliases":[],"title":"A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher con…","description":"A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.","state":0,"publishedAt":"2026-06-26T00:16:51.147+00:00","modifiedAt":"2026-10-25T22:10:00.15+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · secalert@redhat.com · Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","score":4.2,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2026-13218","https://bugzilla.redhat.com/show_bug.cgi?id=2492654"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13218","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-61"],"productCriteria":["cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*","cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-26T00:16:51.147","lastModified":"2026-10-25T22:10:00.150"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-13218","identifiers":["CVE-2026-13218"]},"retained":false,"historicalAffected":[]}],"coverage":[]}