CVE-2026-13325 — A flaw was found in KubeVirt's migration proxy. When...
CVE-2026-13325 漏洞深度分析
漏洞概述
CVE 编号： CVE-2026-13325
CVSS 评分： 8.5（HIGH）
CVSS 向量： CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE 分类： CWE-306
漏洞状态： Analyzed
发布时间： 2026-06-26T11:16:30.830
最后更新： 2026-07-14T13:18:14.483
漏洞描述
A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant's virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing "the additional layer of live migration encryption" without disclosing that it also removes all mutual authentication.
影响分析
此漏洞的具体影响取决于实际利用场景。"
修复建议
- 及时关注厂商发布的安全更新和补丁
- 升级受影响组件到最新版本
- 如无法立即升级，参考厂商提供的临时缓解措施
- 加强网络访问控制和监控