AZL-25673 CVE-2023-26484 affecting package kubevirt for versions less than 0.59.0-20

🗓️ 15 Mar 2023 21:15:08Reported by GoogleType

osv🔗 osv.dev👁 4 Views

KubeVirt before 0.59.0-20 lets virt-handler modify node specs, risking secrets and cross-node access.

Reporter	Title	Published	Views	Family All 24
Tenable Nessus	Azure Linux 3.0 Security Update: kubevirt (CVE-2023-26484)	10 Feb 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: kubevirt (CVE-2023-26484)	12 Sep 202400:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container (SUSE-SU-2023:1967-1)	25 Apr 202300:00	–	nessus
Tenable Nessus	TencentOS Server 4: kubevirt (TSSA-2025:0586)	20 Nov 202500:00	–	nessus
CBLMariner	CVE-2023-26484 affecting package kubevirt for versions less than 0.59.0-20	6 Sep 202419:16	–	cbl_mariner
CBLMariner	CVE-2023-26484 affecting package kubevirt for versions less than 1.2.0-1	17 Apr 202422:02	–	cbl_mariner
Circl	CVE-2023-26484	15 Mar 202323:30	–	circl
CNNVD	KubeVirt 安全漏洞	15 Mar 202300:00	–	cnnvd
CVE	CVE-2023-26484	15 Mar 202320:40	–	cve
Cvelist	CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs	15 Mar 202320:40	–	cvelist