The vulnerability in KubeVirt lies in its RBAC evaluation logic, where subresource names are improperly truncated. This flaw causes the authorization mechanism to incorrectly grant or deny permissions, allowing authenticated users with custom roles to act on subresources they should not control. Consequently, attackers could disclose sensitive data or perform unauthorized operations, and honest users may experience denied access to legitimate resources. The weakness corresponds to CWE‑863, indicating a depletion of permissions-checking controls.

This issue affects Red Hat OpenShift Virtualization 4, specifically the Container Native Virtualization product version 4. No further version specifics are currently listed, so all installations within this product line are potentially impacted.

The CVSS score of 5.4 places the vulnerability in the medium severity range. EPSS data is not available, and the CISA KEV catalog does not list it, indicating no confirmed widespread exploitation yet. The likely exploitation scenario requires an authenticated user with a custom role that includes subresource permissions; the attacker can then make requests to subresources that are incorrectly evaluated. As there is no publicly available exploit code noted, the primary risk remains the potential for unauthorized access and denial of service caused by mis‑evaluated roles.