Approved changes feed: RSS · Atom

cpe:2.3:a:kubevirt:kubevirt:1.6.0:*:*:*:*:kubernetes:*:*

part: a version: 1.6.0 update: *

VendorKubevirt (4dbb168e-0148-5161-8366-0017a2d848a6)
ProductKubevirt (7ace620e-59fb-507c-99ea-2486c6f4aacc)
Edition*
Language*
Software edition*
Target softwarekubernetes
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-64437 vulnerable 2026-06-08 07:39:19.665458 KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
MEDIUM (5)
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
Published: 2025-11-07T23:04:10.913Z
Updated: 2025-11-10T18:50:16.445Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64434 vulnerable 2026-06-08 07:39:19.658345 KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
MEDIUM (4.7)
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
Published: 2025-11-07T22:54:04.772Z
Updated: 2025-11-10T19:03:26.345Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.