This vulnerability arises from improper link resolution before file access in the virt-handler component of KubeVirt, part of Red Hat OpenShift Virtualization 4. An authenticated OpenShift user with edit permissions in a single namespace can replace the virtual machine console socket with a symbolic link pointing to the host's CRI-O socket. This symlink exploitation allows the attacker to hijack virt-handler's privileged connection, granting access to any Unix socket on the host. Such access can lead to full control over the affected node and potentially the entire Kubernetes cluster. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables an attacker with limited namespace edit permissions to escalate privileges by hijacking privileged connections on the host node. This can lead to full control over the node and the entire OpenShift cluster, severely compromising confidentiality, integrity, and availability of the environment. The vulnerability poses a critical risk to cluster security and operational stability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7374 for current remediation guidance. Until an official fix is released, restrict edit permissions carefully and monitor for suspicious symlink manipulations related to virtual machine console sockets. Avoid granting unnecessary namespace edit permissions to untrusted users. Follow vendor updates closely for patches or official mitigations.