{"id":"CVE-2026-13318","revision":"790095d561a446d29e255f669aa28655","records":[{"revision":"790095d561a446d29e255f669aa28655","observedAt":"2026-11-04T18:05:55.7+00:00","statement":{"source":"nvd","id":"CVE-2026-13318","aliases":[],"title":"A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and pas…","description":"A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.","state":0,"publishedAt":"2026-06-26T00:16:51.277+00:00","modifiedAt":"2026-10-25T22:10:00.15+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · secalert@redhat.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2026-13318","https://bugzilla.redhat.com/show_bug.cgi?id=2492659"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13318","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-918"],"productCriteria":["cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*","cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-26T00:16:51.277","lastModified":"2026-10-25T22:10:00.150"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-13318","identifiers":["CVE-2026-13318"]},"retained":false,"historicalAffected":[]}],"coverage":[]}