{"id":"EUVD-2026-39594","enisaUuid":"a6160099-80e0-3079-aa70-f53ab7943a21","description":"A flaw was found in KubeVirt\u0027s virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.","datePublished":"Jun 25, 2026, 11:23:23 PM","dateUpdated":"Jun 26, 2026, 2:58:48 PM","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","references":"https://access.redhat.com/security/cve/CVE-2026-13218\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492654\n","aliases":"CVE-2026-13218\nGHSA-q3jc-42cq-33fj\n","assigner":"redhat","epss":0.14,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"496693c4-26a8-3138-b6d0-27528b6e3860","vulnerability":{"id":"CVE-2026-13218","description":"A flaw was found in KubeVirt\u0027s virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.","datePublished":"Jun 25, 2026, 11:23:23 PM","dateUpdated":"Jun 26, 2026, 2:58:48 PM","status":"PUBLISHED","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","references":"https://access.redhat.com/security/cve/CVE-2026-13218\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492654\n","enisa_id":"EUVD-2026-39594\n","assigner":"redhat","epss":0.14,"dataProcessed":"Nov 6, 2026, 7:18:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f8df231f-f817-34af-9447-95980c087d1e","vulnerability":{"id":"GHSA-q3jc-42cq-33fj","description":"KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite","datePublished":"Jun 26, 2026, 12:32:07 AM","dateUpdated":"Nov 4, 2026, 5:23:34 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-13218\nhttps://access.redhat.com/security/cve/CVE-2026-13218\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492654\nhttps://github.com/kubevirt/kubevirt\nhttps://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103\n","enisa_id":"EUVD-2026-39594\n","aliases":"CVE-2026-13218\nGHSA-q3jc-42cq-33fj\n","epss":0.0,"dataProcessed":"Nov 6, 2026, 9:01:31 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"ce373538-6e67-31e4-82f8-2c3bfbfe445f","advisory":{"id":"msrc_CVE-2026-13218","description":"Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher","datePublished":"Jul 1, 2026, 1:02:59 AM","dateUpdated":"Oct 31, 2026, 1:04:11 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-13218.json\n","aliases":"CVE-2026-13218\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"61653621-9af9-38f5-a2a2-887b41515641","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}}},{"id":"6d2c413d-6640-3eda-b28c-dad49ab7d6d8","product":{"name":"azl3 kubevirt-openvmm 0:1.9.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"7517bad6-347c-30a1-9ae3-cb3d63e27ded","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"79c13552-5ade-35fd-8c85-0ec179f41904","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}