GitHub Advisoryadvisory · Go

GHSA-j6cv-3w8p-vrg8 KubeVirt's authorization mechanism improperly truncates subresource names

MEDIUM Published 2026-04-15 Modified 2026-04-16 Official page ↗
Aliases
CVE-2026-6383
Ecosystem
Go
Packages
kubevirt.io/kubevirt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-04-16

Affected packages

• Go kubevirt.io/kubevirt: <= 1.8.1 (no fix yet)

Description

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Related

Alias · CVE (1)

  • CVE-2026-6383 A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References