Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body

KubeVirt Arbitrary Container File Read

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host…

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler

Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component

KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher