CVE-2026-104795

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...

CVE-2026-104795

The insights-runtime-extractor DaemonSet is vulnerable to a container escape due to insufficient privilege dropping during runtime fingerprinting. The coordinator uses seteuid() to switch users, but it fails to change the real UID (ruid) or saved-set-UID , which remain at 0 . Furthermore, the sec...

CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...

CVE-2026-104795

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned...

CVE-2026-104795: Execution with Unnecessary Privileges

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...

Red Hat OpenShift Permission Licensing and Access Control Vulnerabilities

Red Hat OpenShift Container Platform 4 version has vulnerabilities related to permission granting and access control. These vulnerabilities stem from the insights-runtime-extractor privileged DaemonSet, which, when scanning container processes, only changes the effective UID by setting euid,...

PT-2026-113977

Name of the Vulnerable Software and Affected Versions insights-runtime-extractor affected versions not specified Description The insights-runtime-extractor, running as a privileged DaemonSet, contains a flaw in how it handles privileges when scanning container processes. The coordinator fails to...

SUSE CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

EUVD-2026-57615

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

PT-2026-134966

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

AZL-89193 CVE-2026-7374 affecting package kubevirt for versions less than 1.7.1-7

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to...

CVE-2026-7374

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to...

CVE-2026-7374

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to...

CVE-2024-8676

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...

CVE-2024-8676 Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...

CVE-2024-8676: Improper Authorization

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...