CVE-2026-13318
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-918
Falsificación de solicitud en servidor (SSRF)
Fecha de publicación:
26/06/2026
Última modificación:
06/07/2026
Descripción
*** Pendiente de traducción *** A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.
Impacto
Puntuación base 3.x
6.40
Gravedad 3.x
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:* | ||
| cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:* | 4 (incluyendo) | 4.22.0 (incluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página