CVE-2025-64433 KubeVirt Arbitrary Container File Read

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM...

CVE-2025-64433 KubeVirt Arbitrary Container File Read

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM...

CVE-2025-64433 KubeVirt Arbitrary Container File Read

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM...

CVE-2025-64435

CVE-2025-64435 affects KubeVirt’s virt-controller. A logic flaw allows an attacker to disrupt control of a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod, causing the virt-controller to bind the fake pod to the VMI, leading to incorrect status updates and a...

EUVD-2025-38215

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

CVE-2025-64435 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

CVE-2025-64435 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

CVE-2025-64435 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

Summary Short summary of the problem. Make the impact and severity as clear as possible. A logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

GHSA-9M94-W2VQ-HCF9 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

Summary Short summary of the problem. Make the impact and severity as clear as possible. A logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

KubeVirt Arbitrary Container File Read

Summary Short summary of the problem. Make the impact and severity as clear as possible. Mounting a user-controlled PVC disk within a VM allows an attacker to read any file present in the virt-launcher pod. This is due to erroneous handling of symlinks defined within a PVC. Details Give all detai...

PT-2025-45511

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1 Description KubeVirt, a virtual machine management add-on for Kubernetes, contains a flaw that permits a virtual machine VM to read arbitrary files from the virt-launcher pod's...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: elvish, dagdotdev, spiffe-helper, controller-gen, envconsul, src-fingerprint, petname, http-echo, go-md2man, k3d, kapp, rancher-helm, terraform-provider-azuread, hivemind, mc, docker-credential-ecr-login, kubernetes-csi-external-health-monitor, trillian, flyte,...