This vulnerability arises from improper link resolution before file access (CWE-59) in the virt-handler component of KubeVirt used in Red Hat Container Native Virtualization 4.12. An authenticated user with edit permissions in a namespace can replace the virtual machine console socket with a symbolic link pointing to the host's CRI-O socket. This allows the attacker to hijack virt-handler's privileged connection to the host, enabling access to any Unix socket on the host system. Such access can lead to full control over the node and the entire Kubernetes cluster. The vulnerability is rated critical with a CVSS v3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Successful exploitation allows an authenticated user with namespace edit permissions to escalate privileges by hijacking virt-handler's privileged socket connections. This can lead to unauthorized access to host Unix sockets, potentially resulting in full control over the node and the entire Kubernetes cluster, severely compromising confidentiality, integrity, and availability of the environment.

According to the Red Hat advisories RHSA-2026:20720 and RHSA-2026:20736, no fixes are currently available for this vulnerability in Red Hat Container Native Virtualization. Users are advised to apply all previously released errata relevant to their systems. Patch status is not yet confirmed — check the Red Hat vendor advisories regularly for updates and remediation guidance. Until a fix is released, restrict edit permissions in namespaces to trusted users only and monitor for suspicious activity related to virt-handler socket connections.