A symlink follow vulnerability in KubeVirt's virt-handler migration proxy allows an attacker who can edit a namespace and run pods/exec commands to replace a migration proxy socket with a symlink pointing to the host CRI‑O socket. Because virt‑handler runs as root in the host mount namespace, the symlink target is resolved on the host, enabling the attacker to relay arbitrary data to the container runtime and fully compromise the node. The weakness is a classic path traversal flaw (CWE‑22) that directly threatens confidentiality, integrity, and availability of the affected host.

Red Hat OpenShift Virtualization 4 running the kubevirt virt‑handler component is affected. The vulnerability is present in the container native virtualization 4 product and impacts any virtual machine environment configured with the standard virt‑handler and virt‑launcher components.

The CVSS score of 8.8 classifies this as a high‑severity flaw, and although the EPSS score is not available, the absence of a KEV listing does not reduce its seriousness. The attack requires namespace edit rights and pods/exec privileges, which are typically granted to operators; the exploit path is therefore feasible in many production clusters, especially during live migration events. Once the symlink is in place, the attacker can achieve full node compromise by manipulating the container runtime.