CVE-2026-7374

Published May 26, 2026

Last updated a month ago

CVSS critical 9.9
Container Security

Overview

Description
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
Source
secalert@redhat.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.9
Impact score
6
Exploitability score
3.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

secalert@redhat.com
CWE-59
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CWE-59

Social media

Hype score
Not currently trending

  1. 🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-7374](https://t.co/7Tnc2Mwfgp) A flaw was found in KubeVirt's ... https://t.co/7Tnc2Mwfgp #ZeroDay #PatchManagement #Vulnerability

    @MalwareObserver

    9 Aug 2026

    48 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-7374](https://t.co/7Tnc2Mwfgp) A flaw was found in KubeVirt's ... https://t.co/7Tnc2Mwfgp #PatchManagement #Vulnerability #CVE

    @MalwareObserver

    23 Jul 2026

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 CVE-2026-7374 — CVSS 9.9/10 ██████████ A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/9quYqbtFaw

    @OrizonCyber

    26 May 2026

    71 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.•CVE-2026-79994
  3. On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.•CVE-2026-77179
  4. containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.•CVE-2026-53495
  5. A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.•CVE-2026-78234

References

Sources include official advisories and independent security research.