Vulnerability in KubeVirt's Virtual Machine Management for Kubernetes

CVE-2025-64436

What is CVE-2025-64436?

KubeVirt, a crucial add-on for managing virtual machines within Kubernetes environments, has a vulnerability that arises from improper permissions assigned to the virt-handler service account. In versions 1.5.0 and earlier, these permissions can be exploited by malicious actors to force a virtual machine instance (VMI) to migrate to a node under their control. By leveraging this flaw, an attacker could manipulate node statuses, potentially making all nodes unschedulable and creating a pathway to deploy privileged pods on compromised nodes. This poses a significant risk to the integrity and security of Kubernetes deployments using KubeVirt.

References