PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13208 Red Hat CVE debrief

A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from the request body without validating it against the connection's origin. Each virt-launcher pod connects through a per-VMI pipe socket, but no identity tag is propagated from the pipe path to the server handlers. This allows a compromised virt-launcher process to send forged domain lifecycle events for any other VMI scheduled on the same node, causing virt-handler to erroneously update that VMI's state and disrupt its lifecycle management.

Vendor
Red Hat
Product
Red Hat OpenShift Virtualization 4
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-24
Original CVE updated
2026-07-06
Advisory published
2026-06-24
Advisory updated
2026-07-06

Who should care

Users of KubeVirt, particularly those with virt-launcher pods running on the same node, should be aware of this medium-severity vulnerability. Administrators of Kubernetes environments with KubeVirt installed should assess their exposure and take necessary actions to mitigate the risk.

Technical summary

The vulnerability exists in the virt-handler domain notify server of KubeVirt. Specifically, the gRPC handlers HandleDomainEvent and HandleK8SEvent do not validate the VMI identity against the connection's origin, allowing a compromised virt-launcher process to send forged events for other VMIs on the same node. This could lead to incorrect state updates and lifecycle disruptions for affected VMIs.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could allow a compromised process to interfere with the lifecycle management of other VMIs on the same node.

Recommended defensive actions

  • Apply the vendor-provided patch or update to the latest version of KubeVirt.
  • Review and restrict access to virt-launcher pods and their communication with the virt-handler.
  • Monitor VMI state updates and lifecycle events for anomalies.
  • Implement additional logging and auditing to detect potential exploitation attempts.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-06-24T21:16:52.547Z and was last modified on 2026-07-06T17:51:17.760Z. The NVD entry is currently Analyzed. Vendor references are available for mitigation and issue tracking.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13208 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13208

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13208 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13208

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.