A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated
    OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when
    connecting to virtual machine console sockets. By replacing the console socket with a symlink to the
    host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This
    enables the attacker to access any Unix socket on the host, potentially leading to full control of the
    node and the entire cluster. (CVE-2026-7374)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2401-1 advisory.

    This update for kubevirt-1.6 fixes the following issues

    Update to version 1.6.6, fixes various go embedded security issues:

    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251420).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253559).
    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an     out of bounds       read (bsc#1254014).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253935).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251615).
    - CVE-2026-7374: virt-handler: Privilege escalation and node compromise via symlink following     vulnerability       (bsc#1265467).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260234).

    Release notes: https://github.com/kubevirt/kubevirt/releases/tag/v1.6.6

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2400-1 advisory.

    Update to version 1.7.4, fixes various go embedded security issues:

    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251420).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253559).
    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an     out of bounds       read (bsc#1254014).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253935).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251615).
    - CVE-2026-7374: virt-handler: Privilege escalation and node compromise via symlink following     vulnerability       (bsc#1265467).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260234).

    Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.7.4

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2077-1 advisory.

    This update for kubevirt fixes the following issue:

    CVE-2026-7374: Fixed privilege escalation and node compromise via symlink following vulnerability     (bsc#1265467)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
444167	SCA: security update for kubevirt.io/kubevirt (GHSA-7jcp-v9w4-wjmg)	Tenable Cloud Security	SCA Checks	Local	critical
444167	SCA: security update for kubevirt.io/kubevirt (GHSA-7jcp-v9w4-wjmg)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
321680	SUSE SLES15 Security Update : kubevirt-1.6 (SUSE-SU-2026:2401-1)	Nessus	SuSE Local Security Checks	Local	medium
321638	SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2400-1)	Nessus	SuSE Local Security Checks	Local	medium
317664	SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2077-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-7374

critical

Tenable Plugins

critical

critical

medium

medium

critical