Threats tagged 'ghsa-cgm6-wvp9-4g5h'

CVE-2026-13318 is a server-side request forgery (SSRF) vulnerability in KubeVirt's virt-api port-forward handler. The flaw arises because virt-api uses an IP address reported by the QEMU guest agent inside a VirtualMachineInstance (VMI) without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can exploit this to create a VM that reports an arbitrary IP, enabling port-forward requests to establish TCP tunnels to arbitrary internal or external network destinations, bypassing NetworkPolicy isolation. The issue affects versions prior to 1.10.0-rc.0 and has been fixed starting with 1.10.0-rc.0. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity).