Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-13318 · Microsoft / collected KEV context

EUVD-2026-39595

GHSA-cgm6-wvp9-4g5h

cve-program · CVE-2026-13318

• https://access.redhat.com/security/cve/CVE-2026-13318
• https://bugzilla.redhat.com/show_bug.cgi?id=2492659

euvd · EUVD-2026-39595

• https://access.redhat.com/security/cve/CVE-2026-13318
• https://bugzilla.redhat.com/show_bug.cgi?id=2492659

nvd · CVE-2026-13318

• https://access.redhat.com/security/cve/CVE-2026-13318
• https://bugzilla.redhat.com/show_bug.cgi?id=2492659

osv · GHSA-cgm6-wvp9-4g5h

• https://nvd.nist.gov/vuln/detail/CVE-2026-13318
• https://github.com/kubevirt/kubevirt/pull/18753
• https://github.com/kubevirt/kubevirt/commit/0f5fef3309417f454565412f56f571f48358853f
• https://github.com/kubevirt/kubevirt/commit/df419a0f20aa7ddc9f4512431c3aed9a642ad1e1
• https://access.redhat.com/security/cve/CVE-2026-13318
• https://bugzilla.redhat.com/show_bug.cgi?id=2492659
• https://github.com/kubevirt/kubevirt
• https://github.com/kubevirt/kubevirt/releases/tag/v1.10.0-rc.0

• KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address · Newly collected advisory · 4 Nov 2026