KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn't exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764 Patch
- https://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69 Patch
- https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.5 · kubevirtNVD modified 2026-10-19 13:10
Affected (CPE criteria) 3
cpe:2.3:a:kubevirt:kubevirt:*:*:*:*:*:kubernetes:*:*cpe:2.3:a:kubevirt:kubevirt:1.7.0:alpha0:*:*:*:kubernetes:*:*cpe:2.3:a:kubevirt:kubevirt:1.7.0:beta0:*:*:*:kubernetes:*:*
References 4
- https://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764 Patch
- https://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69 Patch
- https://github.com/kubevirt/kubevirt/pull/15037 Issue Tracking
- https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh Exploit, Vendor Advisory