CVE-2026-7374

CriticalCVSS 9.9/10Last modified Sep 10, 2026

Description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Sep 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-737404.4A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying CVE-2026-737414.3A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system fiCVE-2026-737424.3A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the sCVE-2026-737433.7A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gaCVE-2026-737443.5A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authentCVE-2026-737453.1A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some informatioCVE-2026-737463.1A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operatCVE-2026-737472.5A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an autCVE-2026-737482.2A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensCVE-2026-737499.8Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote atCVE-2026-73757.5UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of serviceCVE-2026-737508.8Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacke
CVE-2026-7374: Critical severity, CVSS 9.9 | Vulnix