The vulnerability exists in KubeVirt's virt-handler domain notify server used by Red Hat OpenShift Virtualization 4. Specifically, the gRPC handlers HandleDomainEvent and HandleK8SEvent trust the VMI identity information from the request body without verifying it against the actual connection origin. Since each virt-launcher pod connects through a per-VMI pipe socket but does not propagate an identity tag from the pipe path to the server handlers, a compromised virt-launcher process can impersonate other VMIs scheduled on the same node. This allows it to send forged domain lifecycle events, causing virt-handler to incorrectly update the state of other VMIs and disrupt their lifecycle management.

The vulnerability allows a low-privileged process (a compromised virt-launcher) on the same node to interfere with the lifecycle management of other VMIs by sending forged lifecycle events. This can disrupt availability by causing erroneous state updates and potentially impacting the operation of other virtual machines. The CVSS score is 6.5 (medium severity) with an attack vector limited to local (AV:L), requiring low privileges (PR:L), no user interaction (UI:N), and causing a high impact on availability (A:H) but no confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13208 for current remediation guidance. No official fix or workaround is explicitly stated in the provided data. Until a patch is available, restricting access to virt-launcher processes and limiting the ability of compromised pods to affect others on the same node may reduce risk.