The vulnerability in Red Hat OpenShift Virtualization 4 involves improper authentication in KubeVirt's virt-handler domain notify server. The gRPC handlers HandleDomainEvent and HandleK8SEvent derive the VMI identity solely from the request body, lacking validation against the connection's origin. Since each virt-launcher pod connects via a per-VMI pipe socket but does not propagate an identity tag, a compromised virt-launcher can send forged lifecycle events for any VMI scheduled on the same node. This causes virt-handler to mistakenly update the state of other VMIs, disrupting their lifecycle management.

The vulnerability allows a local attacker with access to a compromised virt-launcher process to disrupt the lifecycle management of other VMIs on the same node by sending forged domain lifecycle events. This can result in denial of service conditions for those VMIs. There is no impact on confidentiality or integrity of data, but availability is affected. The CVSS 3.1 score is 6.5 (medium severity), reflecting local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13208 for current remediation guidance. No official fix or workaround is indicated in the provided data. Until a patch is available, restrict access to virt-launcher processes and nodes to trusted users to reduce risk.