redhat/container-native-virtualization/virt-controller vulnerabilities

Latest redhat/container-native-virtualization/virt-controller CVEs

Newest publication first

1. CVE-2026-119566 Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

   Published 2026-10-30

   Medium·CVSS 6.3 EPSS 0.20%

   Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx...

2. CVE-2026-102623 Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume

   Published 2026-09-29

   Medium·CVSS 6.5 EPSS 0.31%

   A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate t...

3. CVE-2026-19444 Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

   Published 2026-09-28

   Medium·CVSS 6.5 EPSS 0.23%

   A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. I...

4. CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

   Published 2026-09-14

   High·CVSS 8.7 EPSS 0.64%

   gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/se...

5. CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path

   Published 2026-03-20

   Critical·CVSS 9.1 EPSS 1.6%

   gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted...

6. CVE-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

   Published 2026-02-19

   Medium·CVSS 5.4 EPSS 0.14%

   Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version...

7. CVE-2025-47911 Quadratic parsing complexity in golang.org/x/net/html

   Published 2026-02-05

   Medium·CVSS 5.3 EPSS 0.56%

   The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

8. CVE-2025-65637 Logrus is vulnerable to DoS when using Entry.Writer()

   Published 2025-12-04

   High·CVSS 7.5 EPSS 0.68% PoC

   A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is...

9. CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

   Published 2025-11-19

   Medium·CVSS 5.3 EPSS 0.55%

   SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

10. CVE-2025-58181 Unbounded memory consumption in golang.org/x/crypto/ssh

    Published 2025-11-19

    Medium·CVSS 5.3 EPSS 0.60%

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

11. CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent

    Published 2025-11-13

    High·CVSS 7.5 EPSS 0.67%

    SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.