flaw exists in the KubeVirt virt‑api port‑forward handler. The API reads the target IP directly from the first VM interface reported by the QEMU guest agent and passes it to net.Dial() without validation. When a VirtualMachineInstance uses a bridge or secondary‑only network binding, this IP is fully controlled by the VM owner. An attacker with kubevirt.io:edit privileges can therefore create a VM whose guest agent reports an arbitrary IP and then issue a port‑forward request, establishing a bidirectional TCP tunnel from the cluster’s internal network to any routable destination.

The vulnerability affects Red Hat OpenShift. No specific version range is listed in the advisory, so any release that incorporates this code path may be impacted until a patched version is deployed.

The CVSS score of 6.4 indicates moderate severity; EPSS is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires the ability to create or modify a VMI with edit permissions, which is typically limited to certain administrators. The attacker can bypass cluster NetworkPolicy isolation and reach arbitrary external IPs from within the cluster, potentially facilitating further lateral movement or data exfiltration. The risk is elevated in environments that use bridge or secondary‑only networking for VMs and where privileged VMI creation is broadly allowed.