The vulnerability (CVE-2026-13325) exists in KubeVirt's migration proxy when spec.configuration.migrations.disableTLS is set to true. This configuration causes the target virt-handler to bind a plain TCP listener on all interfaces (0.0.0.0/::) on a random port without authentication, peer allow-list, or handshake token. This listener proxies directly into the virtqemud control socket of the target virt-launcher, allowing an attacker with a pod on the cluster network to issue unfiltered libvirt RPC commands against another tenant's VM. The attacker can read VM memory and configuration, modify VM state via QMP, or destroy the VM. The bind address is unconditionally 0.0.0.0, meaning the port remains reachable on the pod network even if a dedicated migration network is configured. The API documentation only mentions removal of live migration encryption but does not disclose the removal of mutual authentication. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 score is 8.5 (High), with attack vector Network, attack complexity High, privileges required Low, no user interaction, and scope changed. Impact includes high confidentiality, integrity, and availability impacts.

An attacker with a running pod on the cluster network can connect to the exposed TCP listener and issue unfiltered libvirt RPC commands against another tenant's virtual machine. This can lead to unauthorized reading of VM memory and configuration, modification of VM state, or destruction of the VM. The vulnerability breaks tenant isolation and allows privilege escalation within the cluster environment. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of virtual machines.

The vendor advisory indicates this CVE has been marked as Rejected by the assigning CNA, and no official patch or fix is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid setting spec.configuration.migrations.disableTLS to true to prevent exposure of the unauthenticated TCP listener. Configuring a dedicated migration network does not mitigate the exposure since the listener binds to all interfaces. Monitor vendor advisories for updates or fixes. No other specific mitigations are described in the advisory.