CVE-2026-7374Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-59

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 3d ago at 2 mentions (2026-05-26); latest day: 1
6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

Disclosure

350.0%

Patch

350.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-26	2	Disclosure1Patch1
2026-05-29	2	Disclosure2
2026-07-23	1	Patch1
2026-08-09	1	Patch1

Full discourse6 posts

Gray Hats@the_yellow_fall135d
Disclosure
Discover how the critical KubeVirt privilege escalation flaw (CVE-2026-7374) allows container runtime hijacking and creates a cluster takeover risk. #Cybersecurity #Kubernetes #KubeVirt #Infosec #CloudSecurity #PrivilegeEscalation https://securityonline.info/kubevirt-privilege-escalation-flaw-cve-2026-7374/ https://t.co/F695kOjcGq
Post summary
The tweet promotes an article disclosing CVE-2026-7374 as a critical privilege escalation flaw in KubeVirt, highlighting its potential to hijack container runtimes and enable cluster takeover.
02061465
12.5K followersView on X
VulDB 🛡@vuldb137d
Disclosure
There is a new vulnerability with elevated criticality in KubeVirt (CVE-2026-7374) https://vuldb.com/vuln/365646
Post summary
A newly identified high‑severity vulnerability (CVE‑2026‑7374) has been reported in KubeVirt, with a link to a vulnerability database for additional information.
0001086
2.2K followersView on X
Orizon@OrizonCyber137d
Patch
🚨 CVE-2026-7374 — CVSS 9.9/10 ██████████ A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/9quYqbtFaw
Post summary
A critical vulnerability (CVE‑2026‑7374) has been disclosed in KubeVirt’s virt‑handler affecting authenticated OpenShift users; a patch has already been released.
1000087
43 followersView on X
MalwareObserver@MalwareObserver62d
Patch
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-7374](https://access.redhat.com/errata/RHSA-2026:20720) A flaw was found in KubeVirt's ... https://access.redhat.com/errata/RHSA-2026:20720 #ZeroDay #PatchManagement #Vulnerability
Post summary
Red Hat has released an errata for CVE‑2026‑7374 affecting KubeVirt, providing a patch to address the vulnerability.
0000053
18 followersView on X
MalwareObserver@MalwareObserver80d
Patch
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-7374](https://access.redhat.com/errata/RHSA-2026:20720) A flaw was found in KubeVirt's ... https://access.redhat.com/errata/RHSA-2026:20720 #PatchManagement #Vulnerability #CVE
Post summary
Red Hat alerts users to CVE‑2026‑7374 affecting KubeVirt and provides a link to the errata where the patch is available.
0000024
13 followersView on X
Upwind Security MDR@UpwindMDR135d
Disclosure
🚨 Critical - KubeVirt / OpenShift Privilege Escalation via virt-handler (CVE-2026-7374) A flaw in KubeVirt’s virt-handler component allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation and hijack privileged host connections. Successful exploitation may allow access to sensitive host-level Unix sockets and could impact the security of the underlying node and cluster. 👉 Affected: KubeVirt / OpenShift environments using vulnerable virt-handler versions
Post summary
A critical privilege escalation vulnerability (CVE-2026-7374) in KubeVirt's virt-handler permits authenticated OpenShift users with namespace‑edit rights to exploit improper symlink validation and gain host‑level access, jeopardizing node and cluster security.
0000071
196 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-7374

Orizon[verified]@OrizonCyberPatch

A critical vulnerability (CVE‑2026‑7374) has been disclosed in KubeVirt’s virt‑handler affecting authenticated OpenShift users; a patch has already been released.

MalwareObserver[verified]@MalwareObserverPatch

Red Hat has released an errata for CVE‑2026‑7374 affecting KubeVirt, providing a patch to address the vulnerability.

MalwareObserver[verified]@MalwareObserverPatch

Red Hat alerts users to CVE‑2026‑7374 affecting KubeVirt and provides a link to the errata where the patch is available.

Upwind Security MDR[verified]@UpwindMDRDisclosure

A critical privilege escalation vulnerability (CVE-2026-7374) in KubeVirt's virt-handler permits authenticated OpenShift users with namespace‑edit rights to exploit improper symlink validation and gain host‑level access, jeopardizing node and cluster security.

Gray Hats@the_yellow_fallDisclosure

The tweet promotes an article disclosing CVE-2026-7374 as a critical privilege escalation flaw in KubeVirt, highlighting its potential to hijack container runtimes and enable cluster takeover.

VulDB 🛡@vuldbDisclosure

A newly identified high‑severity vulnerability (CVE‑2026‑7374) has been reported in KubeVirt, with a link to a vulnerability database for additional information.