On a compromised KubeVirt node the virt-handler service account can be used to modify all node specs

...

Fluid security vulnerabilities

Fluid is an open source Kubernetes native distributed dataset orchestrator and gas pedal from the Cloud Native Computing Foundation for data-intensive applications such as Big Data and AI applications. A security vulnerability exists in Fluid versions 0.7.0 through 0.8.6, which stems from the...

KubeVirt security vulnerabilities

Kubevirt is a virtual machine manager. A security vulnerability exists in KubeVirt 0.59.0 and later, which stems from the ability to modify all node specifications using the virt-handler service account if a malicious user takes over a Kubernetes node running virt-handler...