SUSE CVE-2023-26484

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to...

CVE-2023-26484

CVE-2023-26484 affects KubeVirt up to version 0.59.0. If an attacker compromises a Kubernetes node where virt-handler runs, the virt-handler service account can modify all node specs, enabling reading secrets and pod-level actions on other nodes and potentially elevating privileges cluster-wide. ...

CVE-2023-26484: Incorrect Authorization

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to...