A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attacker with a running pod on the cluster network can connect to this listener and issue unfiltered libvirt RPC commands against another tenant's virtual machine, including reading VM memory and configuration, modifying VM state via QMP, or destroying the VM. The bind address is unconditionally 0.0.0.0 — configuring a dedicated migration network via migrations.network only changes the advertised migration IP, not the listener bind address, so the port remains reachable on the pod network even when a dedicated migration network is configured. The API documentation describes disableTLS as removing "the additional layer of live migration encryption" without disclosing that it also removes all mutual authentication.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-13325 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
Red Hat Product Security has come to the conclusion that this CVE is not needed.
CVE-2026-13325
✕ Withdrawn — historical dataHIGHPre-NVD 8.5
8.5CVSS
- CVSS v3
- 8.5
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
June 26, 2026
Last Modified
July 21, 2026
References (2)
- secalert@redhathttps://access.redhat.com/security/cve/CVE-2026-13325
- secalert@redhathttps://bugzilla.redhat.com/show_bug.cgi?id=2493378
Frequently asked(4)
What is CVE-2026-13325?
CVE-2026-13325 is a rejected CVE ID: its record was withdrawn on August 4, 2026 and no longer describes a vulnerability. Reason given: Red Hat Product Security has come to the conclusion that this CVE is not needed.
When was the CVE record for CVE-2026-13325 published?
The CVE record for CVE-2026-13325 was published on June 26, 2026. EchelonGraph's copy of the record carries a last-modified date of July 21, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-13325?
CVE-2026-13325 has a CVSS base score of 8.5 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-13325?
There is nothing to remediate under CVE-2026-13325: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.