This vulnerability involves a flaw in the Role-Based Access Control (RBAC) evaluation logic of KubeVirt, a component of Red Hat OpenShift Virtualization 4. The authorization mechanism improperly truncates subresource names, causing incorrect permission evaluations. As a result, authenticated users assigned specific custom roles may gain unauthorized access to subresources, potentially exposing sensitive data or enabling unauthorized operations. Additionally, legitimate users may experience denial of access due to this flawed evaluation. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability. The vendor advisory does not currently specify any patch or remediation status.

The vulnerability allows authenticated users with certain custom roles to bypass intended access controls on subresources within Red Hat OpenShift Virtualization 4. This can lead to unauthorized disclosure of sensitive information or unauthorized actions on those subresources. Additionally, legitimate users may be denied access to resources they should have permission to use. There are no known exploits in the wild at this time. The impact affects confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6383 for current remediation guidance. Until an official fix is released, review and restrict custom RBAC roles to minimize exposure to this issue. Avoid granting overly broad permissions on subresources and monitor for any unusual access patterns related to subresource operations.