CVE-2026-13318

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.

• CWE-918

• https://access.redhat.com/security/cve/CVE-2026-13318Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2492659Issue Tracking, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jul 6, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13308Autel MaxiCharger AC Elite Home WebSockets Integer Underflow…8.1
• CVE-2026-13309Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overf…6.8
• CVE-2026-1331MeetingHub developed by HAMASTAR Technology has an Arbitrary…9.8
• CVE-2026-13311shell-quote prior to 1.8.5 finalizes parsed tokens in parse(…8.7
• CVE-2026-13314Malicious HTML content could be injected into the content re…2
• CVE-2026-13316A flaw has been found in foreman when HTTP parameters are mo…4.4
• CVE-2026-1332MeetingHub developed by HAMASTAR Technology has a Missing Au…6.9
• CVE-2026-13320GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-13321The BIND resolver accepts validly-signed NSEC records where …8.6
• CVE-2026-13322A flaw was found in KubeVirt's downward metrics virtio-seria…3.8
• CVE-2026-13323In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoi…8.7
• CVE-2026-13325Rejected reason: Red Hat Product Security has come to the co…