EUVD-2026-31824Published

Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

cve-program · CVE-2026-7374

Published

kubevirt

https://github.com/kubevirt/kubevirt

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1.6.6",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.7.0",
                            "lessThan": "1.7.4",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.8.0",
                            "lessThan": "1.8.3",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "kubevirt",
                    "collectionURL": "https://github.com/kubevirt/kubevirt"
                }

container-native-virtualization/virt-handler

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.12",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779375376",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.12::el8"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.13",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1778999881",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.13::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.14",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779321599",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.14::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.15",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1778859977",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.15::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.16",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1778861274",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.16::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.17",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779174925",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.17::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.18",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1778887155",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.18::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.19",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779289071",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.19::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.20",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779288737",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.20::el9"
                    ]
                }

container-native-virtualization/virt-handler-rhel9

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Container Native Virtualization 4.21",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "container-native-virtualization/virt-handler-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1779420069",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:container_native_virtualization:4.21::el9"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-31824

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 26, 2026, 1:14:53 PM

dateUpdated: Sep 10, 2026, 12:05:01 PM

13 related source bulletins · separate from aliases

RHSA-2026:20736: Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

CVE-2026-7374

SUSE-SU-2026:2077-1: Security update for kubevirt

CVE-2026-7374

msrc_CVE-2026-7374: Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability

CVE-2026-7374

RHSA-2026:20763: Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

CVE-2026-7374

RHSA-2026:20890: Red Hat Security Advisory: OpenShift Virtualization v4.14 Images

CVE-2026-7374

RHSA-2026:20782: Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

CVE-2026-7374

RHSA-2026:20886: Red Hat Security Advisory: OpenShift Virtualization v4.13 Images

CVE-2026-7374

RHSA-2026:20975: Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

CVE-2026-7374

RHSA-2026:20866: Red Hat Security Advisory: OpenShift Virtualization v4.15 Images

CVE-2026-7374

WID-SEC-W-2026-1680: Red Hat OpenShift Virtualization: Schwachstelle ermöglicht Privilegieneskalation

CVE-2026-7374

RHSA-2026:20720: Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

CVE-2026-7374

RHSA-2026:20767: Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

CVE-2026-7374

RHSA-2026:20825: Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

CVE-2026-7374

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-7374

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-59

Original publisher date fields

published: 2026-05-26T14:16:40.717

lastModified: 2026-09-10T13:20:31.720

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-7jcp-v9w4-wjmg

Published

kubevirt.io/kubevirt

SEMVER · introduced 1.8.0-alpha.0 → fixed 1.8.3

kubevirt.io/kubevirt

SEMVER · introduced 1.7.0-alpha.0 → fixed 1.7.4

kubevirt.io/kubevirt

SEMVER · introduced 0 → fixed 1.6.6

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-5848

Published

kubevirt.io/kubevirt

SEMVER · introduced 0 → fixed 1.6.6 → introduced 1.7.0-alpha.0 → fixed 1.7.4 → introduced 1.8.0-alpha.0 → fixed 1.8.3

Original source record · Cite this exact observation · Complete original publisher JSON