Skip to main content

[CVE-2026-13622]: virt-handler migration proxy follows symlinks, allowing container escape to host

· 2 min read
Po-Han Huang

A symlink-following vulnerability was found in KubeVirt's virt-handler migration proxy.

During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod using /proc/<pid>/root/<path> via net.Dial(), without symlink protection. These socket paths reside in QEMU-owned directories that are writable by the virt-launcher user.

An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink pointing to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem. The bidirectional io.Copy proxy then relays attacker-controlled bytes to the container runtime, enabling full node compromise.

Affected Versions​

All currently supported Harvester versions are affected, including 1.6.1 and earlier, 1.7.3 and earlier, and 1.8.2 and earlier.

Your cluster is affected by this vulnerability, if the following command returns at least one virt-launcher pods:

kubectl get po -lkubevirt.io=virt-launcher -A

Fixed Versions​

A fix is not yet available. SUSE is actively working on a resolution, targeting Harvester 1.9.

Meanwhile, you can use the following workaround to protect your clusters' virt-launcher pods against exploitation.

Workaround​

Use a ValidatingAdmissionPolicy to deny pods/exec and pods/attach operations targeting virt-launcher pods.

Apply the following resources to your Harvester cluster:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: deny-virt-launcher-exec
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:   [""]
      apiVersions: ["v1"]
      operations:  ["CONNECT"]
      resources:   ["pods/exec", "pods/attach"]
  matchConditions:
    - name: is-virt-launcher
      expression: >
        request.name.startsWith("virt-launcher-")
  validations:
    - expression: >
        request.userInfo.username == "system:admin" ||
        request.userInfo.username.startsWith("system:serviceaccount:harvester-system")
      messageExpression: "'CVE-2026-13622 mitigation. Rejected exec/attach request from ' + request.userInfo.username"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: deny-virt-launcher-exec-binding
spec:
  policyName: deny-virt-launcher-exec
  validationActions: [Deny]

This policy blocks exec and attach requests to virt-launcher pods from non-admin and non-Harvester service accounts, to prevent an attacker from replacing the migration proxy sockets with symlinks.

note

Once you have upgraded to a fixed version of Harvester, remove this policy and binding:

kubectl delete validatingadmissionpolicybinding deny-virt-launcher-exec-binding
kubectl delete validatingadmissionpolicy deny-virt-launcher-exec

References​