KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0586 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-26484:
    KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a     malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running,     the virt-handler service account can be used to modify all node specs. This can be misused to lure-in     system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec     into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node     until potentially having full privileged access to the whole cluster. The simplest way to exploit this,     once a user could compromise a specific node, is to set with the virt-handler service account all other     nodes to unschedulable and simply wait until system-critical components with high privileges appear on its     node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a     webhook which will block the `virt-handler` service account to modify the spec of a node.

    CVE-2025-22869:
    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kubevirt installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-26484 advisory.

  - KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a     malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running,     the virt-handler service account can be used to modify all node specs. This can be misused to lure-in     system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec     into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node     until potentially having full privileged access to the whole cluster. The simplest way to exploit this,     once a user could compromise a specific node, is to set with the virt-handler service account all other     nodes to unschedulable and simply wait until system-critical components with high privileges appear on its     node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a     webhook which will block the `virt-handler` service account to modify the spec of a node. (CVE-2023-26484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-26484 advisory.

  - KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a     malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running,     the virt-handler service account can be used to modify all node specs. This can be misused to lure-in     system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec     into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node     until potentially having full privileged access to the whole cluster. The simplest way to exploit this,     once a user could compromise a specific node, is to set with the virt-handler service account all other     nodes to unschedulable and simply wait until system-critical components with high privileges appear on its     node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a     webhook which will block the `virt-handler` service account to modify the spec of a node. (CVE-2023-26484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1967-1 advisory.

    - CVE-2023-26484: Limit operator secrets permission. (bsc#1209359)

    kubevirt is also rebuilt with a supported GO compiler (bsc#1208916)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276297	TencentOS Server 4: kubevirt (TSSA-2025:0586)	Nessus	Tencent Local Security Checks	high
215344	Azure Linux 3.0 Security Update: kubevirt (CVE-2023-26484)	Nessus	Azure Linux Local Security Checks	high
207011	CBL Mariner 2.0 Security Update: kubevirt (CVE-2023-26484)	Nessus	MarinerOS Local Security Checks	high
174718	SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / kubevirt-tests / etc (SUSE-SU-2023:1967-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-26484

high

Tenable Plugins

high

high

high

high