A flaw in KubeVirt’s network annotation generator allows a tenant with kubevirt.io:edit permissions to inject unvalidated networkName values into a VirtualMachineInstance’s launcher pod. When the ExternalNetResourceInjection feature gate is enabled, the plugin skips the standard NAD validation, and the attacker can supply a JSON NetworkSelectionElement array that specifies any namespace, network attachment, static IP, and MAC address. This results in the launcher pod being attached to arbitrary networks across namespaces, enabling cross‑namespace connectivity and IP/MAC impersonation on normally isolated network segments.

Red Hat OpenShift Virtualization 4 is affected, specifically the KubeVirt component starting with version 1.8.0 (first shipped in OpenShift Virtualization 4.21). Any cluster that has enabled the ExternalNetResourceInjection Beta feature gate is vulnerable, regardless of the specific OpenShift Virtualization minor version. The vulnerability directly impacts tenants that can create or modify VirtualMachineInstances with Multus network configurations.

The CVSS score is 4.9, indicating a medium confidentiality impact when the feature gate is enabled. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires cluster‑admin access to enable the feature gate and tenant permissions to edit kubevirt resources. The attack is less likely to succeed by default because the gate is off and is restricted to cluster‑admins, but once enabled, the path to compromise is straightforward and does not require additional privilege escalation. Consequently, organizations should treat the risk as moderate but mitigate promptly if the feature is required for operational reasons.