On a compromised node, the virt-handler service account can be used to modify all node specs

🗓️ 16 Mar 2023 16:04:42Reported by GitHub Advisory DatabaseType

On compromised node, virt-handler service account can modify all node specs, potentially leading to cluster-wide privileged acces

Reporter	Title	Published	Views	Family All 24
Tenable Nessus	Azure Linux 3.0 Security Update: kubevirt (CVE-2023-26484)	10 Feb 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: kubevirt (CVE-2023-26484)	12 Sep 202400:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container (SUSE-SU-2023:1967-1)	25 Apr 202300:00	–	nessus
Tenable Nessus	TencentOS Server 4: kubevirt (TSSA-2025:0586)	20 Nov 202500:00	–	nessus
CBLMariner	CVE-2023-26484 affecting package kubevirt for versions less than 0.59.0-20	6 Sep 202419:16	–	cbl_mariner
CBLMariner	CVE-2023-26484 affecting package kubevirt for versions less than 1.2.0-1	17 Apr 202422:02	–	cbl_mariner
Circl	CVE-2023-26484	15 Mar 202323:30	–	circl
CNNVD	KubeVirt 安全漏洞	15 Mar 202300:00	–	cnnvd
CVE	CVE-2023-26484	15 Mar 202320:40	–	cve
Cvelist	CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs	15 Mar 202320:40	–	cvelist

Vulners

Node

Source	Link
github	www.github.com/kubevirt/kubevirt/security/advisories/GHSA-cp96-jpmq-xrr2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-26484
github	www.github.com/kubevirt/kubevirt/issues/9109
github	www.github.com/advisories/GHSA-cp96-jpmq-xrr2

27 Mar 2023 22:24Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18.2

EPSS0.00245

SSVC