This vulnerability arises because virt-api's port-forward handler uses the IP address reported by the QEMU guest agent inside a VM without validation, passing it directly to net.Dial(). For VMIs using non-masquerade network bindings, the guest agent can report arbitrary IP addresses. An attacker with kubevirt.io:edit permissions can create a malicious VM that reports a crafted IP, then initiate a port-forward request to establish a bidirectional TCP tunnel from the cluster-internal network position to any routable IP address. This bypasses NetworkPolicy isolation controls, potentially allowing unauthorized internal network access.

An attacker with edit permissions on kubevirt.io can exploit this vulnerability to bypass Kubernetes NetworkPolicy restrictions by creating a VM that reports arbitrary IP addresses. This enables the attacker to establish TCP tunnels from within the cluster network to any routable destination, potentially accessing internal services or external systems that should be isolated. The impact includes limited confidentiality and integrity loss but no availability impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13318 for current remediation guidance. Until a fix is available, restrict kubevirt.io:edit permissions to trusted users only to reduce the risk of exploitation. Monitor for unusual port-forward requests and consider network segmentation to limit exposure.