A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2401-1 advisory.

    This update for kubevirt-1.6 fixes the following issues

    Update to version 1.6.6, fixes various go embedded security issues:

    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251420).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253559).
    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an     out of bounds       read (bsc#1254014).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253935).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251615).
    - CVE-2026-7374: virt-handler: Privilege escalation and node compromise via symlink following     vulnerability       (bsc#1265467).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260234).

    Release notes: https://github.com/kubevirt/kubevirt/releases/tag/v1.6.6

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2400-1 advisory.

    Update to version 1.7.4, fixes various go embedded security issues:

    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251420).
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253559).
    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an     out of bounds       read (bsc#1254014).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253935).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251615).
    - CVE-2026-7374: virt-handler: Privilege escalation and node compromise via symlink following     vulnerability       (bsc#1265467).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260234).

    Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.7.4

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2077-1 advisory.

    This update for kubevirt fixes the following issue:

    CVE-2026-7374: Fixed privilege escalation and node compromise via symlink following vulnerability     (bsc#1265467)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
321680	SUSE SLES15 Security Update : kubevirt-1.6 (SUSE-SU-2026:2401-1)	Nessus	SuSE Local Security Checks	medium
321638	SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2400-1)	Nessus	SuSE Local Security Checks	medium
317664	SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2077-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2026-7374

critical

Tenable Plugins

medium

medium

critical