CVE-2026-6383CWE-863

Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation

Medium · published April 15, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-15T18:22Z
EPSS history
Timeline
  • 15 APR 18:22Z
    Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation
    cvelistv5