{"id":"CVE-2026-13218","aliases":["GO-2026-6914"],"url":"https://o3.security/vulnerability/CVE-2026-13218","summary":"KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite","details":"A flaw was found in KubeVirt's virt-handler network cache handling. The writeToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.","published":"2026-06-26T00:32:07Z","modified":"2026-11-05T23:25:35.991938771Z","cvss":{"score":4.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"kubevirt.io/kubevirt","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13218"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-13218"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492654"},{"type":"PACKAGE","url":"https://github.com/kubevirt/kubevirt"},{"type":"WEB","url":"https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/network/cache/cache.go#L90-L103"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T23:25:35.991938771Z"}}