Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-13218 · Microsoft / collected KEV context

EUVD-2026-39594

GHSA-q3jc-42cq-33fj

GO-2026-6914

cve-program · CVE-2026-13218

• https://access.redhat.com/security/cve/CVE-2026-13218
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654

euvd · EUVD-2026-39594

• https://access.redhat.com/security/cve/CVE-2026-13218
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654

nvd · CVE-2026-13218

• https://access.redhat.com/security/cve/CVE-2026-13218
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654

osv · GHSA-q3jc-42cq-33fj

• https://nvd.nist.gov/vuln/detail/CVE-2026-13218
• https://access.redhat.com/security/cve/CVE-2026-13218
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654
• https://github.com/kubevirt/kubevirt
• https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103

osv · GO-2026-6914

• https://github.com/advisories/GHSA-q3jc-42cq-33fj
• https://nvd.nist.gov/vuln/detail/CVE-2026-13218
• https://access.redhat.com/security/cve/CVE-2026-13218
• https://bugzilla.redhat.com/show_bug.cgi?id=2492654
• https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103

• KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite in kubevirt.io/kubevirt · Newly collected advisory · 5 Nov 2026
• KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite · Advisory content revised · 5 Nov 2026
• KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite · Newly collected advisory · 4 Nov 2026