Network Cache Handling Flaw in KubeVirt's virt-handler Component

CVE-2026-13218

What is CVE-2026-13218?

A vulnerability exists in KubeVirt's virt-handler related to network cache handling. The flaw is in the WriteToCachedFile function, which improperly manages file writing and ownership changes due to a lack of symlink protection. This allows a user with access to the virt-launcher container to place a symlink at the cache file path, leading virt-handler to overwrite arbitrary host files with potentially malicious JSON content and alter their ownership. This poses significant security risks, as it could result in unauthorized data manipulation or system compromise.

References