Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2025-64437: KubeVirt: Unprivileged user can modify host files
CVE-2025-64437 · published 11 months ago
Summary
Versions of KubeVirt before 1.5.3 and 1.6.1 have a security flaw that allows an attacker with control of the virt-launcher pod to modify sensitive files on the host machine. This could compromise data confidentiality, integrity, and availability. Update to version 1.5.3 or 1.6.1 to fix the issue.
What to do
- Update kubevirt.io kubevirt to version 1.5.3.
- Update kubevirt.io kubevirt to version 1.6.1.
- Update kubevirt kubevirt to version 1.5.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | kubevirt.io | kubevirt |
< 1.5.3 >= 1.6.0-alpha.0, < 1.6.1 Fix: upgrade to 1.5.3
|
| – | kubevirt | kubevirt |
< 1.5.3 1.6.0 cpe:2.3:a:kubevirt:kubevirt:*:*:*:*:*:kubernetes:*:* |
Original advisory text
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64437... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-64437 Vendor Advisory
- https://github.com/advisories/GHSA-2r4r-5x78-mvqf
- https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6... Patch
- https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c0065... Patch
- https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f8... Patch
- https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqf Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-59Link Following
Timeline
Published7 Nov 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta