KubeVirt's virt-api component has an authentication bypass vulnerability in the Kubernetes aggregation layer due to improper validation of the Common Name (CN) in client TLS certificates. This flaw allows an attacker with a valid front-end proxy certificate and network access to the virt-api service to impersonate the Kubernetes API server aggregator, bypassing RBAC controls. Exploitation requires possession of a trusted certificate and network access within the cluster, limiting the attack surface. Successful exploitation could enable a pod-level attacker to escalate privileges and manipulate virtual machine workloads, impacting availability. The issue is fixed in KubeVirt versions 1.5.3, 1.6.1, and 1.7.0-rc.0.