This vulnerability arises from a flaw in KubeVirt's Role-Based Access Control (RBAC) evaluation logic within Red Hat OpenShift Virtualization 4. Specifically, the authorization mechanism incorrectly truncates subresource names during permission evaluation, leading to improper access control decisions. As a result, authenticated users assigned specific custom roles may either gain unauthorized access to subresources—potentially exposing sensitive information or performing unauthorized actions—or be improperly denied access to resources they should legitimately access. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low complexity, and limited impact on confidentiality and integrity without availability impact. The vendor advisory linked does not specify any remediation or patch availability at this time.

The vulnerability can lead to unauthorized disclosure of information or unauthorized actions by authenticated users with certain custom roles due to incorrect permission evaluations. Additionally, legitimate users may experience denial of access to resources. There is no indication of impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6383 for current remediation guidance. Until an official fix is available, review and carefully audit custom RBAC roles and permissions to minimize risk. Avoid granting overly broad custom roles that could be exploited due to this flaw. Monitor Red Hat communications for updates on patches or workarounds.