PT-2026-33165 · Kubevirt · Kubevirt

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-6383

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description A flaw exists in the Role-Based Access Control (RBAC) evaluation logic where the authorization mechanism improperly truncates subresource names. This leads to incorrect permission evaluations, allowing authenticated users with specific custom roles to gain unauthorized access to subresources. This may result in the disclosure of sensitive information or the execution of unauthorized actions. Furthermore, legitimate users may be denied access to resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-6383

GHSA-J6CV-3W8P-VRG8

Affected Products

Kubevirt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-6383 · Security Note
• https://osv.dev/vulnerability/GHSA-j6cv-3w8p-vrg8 · Vendor Advisory
• https://github.com/kubevirt/kubevirt · Note
• https://github.com/kubevirt/kubevirt/issues/17337 · Note
• https://twitter.com/CVEnew/status/2044737938630574116 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-6383 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2458741 · Note