The vulnerability resides in KubeVirt’s virt-handler component, where improper symlink validation allows a user with edit permissions in a single namespace to replace the virtual machine console socket with a symlink pointing to the host’s container runtime socket. This hijacks virt-handler’s privileged connection, giving the attacker access to any Unix socket on the host. Accessing the container runtime socket can yield full control of the node and, by extension, the entire OpenShift cluster. The flaw is a classic example of CWE‑59, Path Traversal, and results in remote code execution or full system compromise.

Red Hat OpenShift Virtualization 4, specifically the virt-handler component in the container_native_virtualization product. No version numbers are supplied in the data, so any deployment of this component is potentially impacted.

This flaw carries a CVSS score of 9.9, indicating critical severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV. Based on the description, the attack can be carried out by an authenticated OpenShift user with namespace‑level edit rights, so the attack vector is internal to the cluster via legitimate credentials. Once the symlink is placed, the attacker can pivot from the virt-handler service to host sockets without additional privileges. The combination of a privileged service and host socket access makes exploitation both straightforward and highly damaging.