KubeVirt’s virt‑handler component contains a flaw in its domain notify server; the gRPC handlers for handling domain events tie the Virtual Machine Instance identity solely to the contents of the request body, with no verification of the caller’s origin. This design permits a compromised or malicious virt‑launcher process to fabricate lifecycle events and announce them as if they came from any VMI on the same node. The result is the virt‑handler updating the state of arbitrary VMIs, potentially leading to denial of service or unintended termination or suspension of virtual machines. The weakness is an authentication bypass (CWE‑287).

The vulnerability affects Red Hat OpenShift Virtualization 4 through its KubeVirt integration, specifically the virt‑handler component that processes VMI-related gRPC notifications. Version specifics are not disclosed in the CNA data, meaning any deployment that includes this component is potentially affected until a fix is applied.

A CVSS score of 6.5 indicates moderate severity. EPSS data is unavailable and the issue is not currently listed in the CISA KEV catalog. Attackers must be able to execute code within a virt‑launcher pod on the same host to send forged gRPC messages, but once that condition is met they can impersonate any VMI identity and trigger lifecycle events that disrupt target VM operations.