{"id":"CVE-2026-13318","revision":"ab46fdb2f79742d28b8127377e32ea58","records":[{"revision":"ab46fdb2f79742d28b8127377e32ea58","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-13318","aliases":[],"title":"Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip","description":"A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.","state":0,"publishedAt":"2026-06-25T23:23:38.121+00:00","modifiedAt":"2026-06-26T12:35:31.627+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"container-native-virtualization/virt-api","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Virtualization 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"container-native-virtualization/virt-api\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:container_native_virtualization:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"container-native-virtualization/virt-api-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Virtualization 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"container-native-virtualization/virt-api-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:container_native_virtualization:4\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2026-13318","https://bugzilla.redhat.com/show_bug.cgi?id=2492659"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-13318","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-13318","identifiers":["CVE-2026-13318"]},"retained":false,"historicalAffected":[]}],"coverage":[]}