CVE-2026-102623 in OpenShift Virtualization
Summary
by MITRE • 09/29/2026
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within KubeVirt represents a critical reliability issue stemming from insufficient input validation by the virt-controller component. This flaw allows an authenticated user who possesses permissions to create Virtual Machine Instances (VMIs) to trigger a Denial of Service condition through specifically crafted requests. The core technical deficiency lies in the controller's failure to properly validate volume configurations, particularly regarding ephemeral volumes. When a virtual machine definition containing an empty ephemeral volume is submitted, the virt-controller encounters an unhandled exception during its processing routine. This lack of robust error handling and boundary checking means that malformed input directly compromises the stability of the control plane component responsible for managing these resources.
The operational impact of this vulnerability extends beyond a simple application crash. Because the malformed virtual machine definition persists within the cluster state, the virt-controller does not simply fail once but enters a continuous crash loop. Every time the controller attempts to reconcile or process the persistent object containing the invalid configuration, it triggers the same unhandled exception and crashes again. This cyclical failure disrupts the entire lifecycle management of virtual machines across the environment. Other legitimate VM operations may be delayed, failed, or stalled as the controller is unable to perform its normal duties while trapped in this error state. Consequently, administrators lose visibility and control over their Kubernetes-based virtualization infrastructure until the offending resource is manually removed or the component is restarted with a workaround applied.
From a threat modeling perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to verify that user-supplied data meets expected criteria before processing. It also relates to CWE-754 Improper Check for Unusual or Exceptional Conditions, where the application does not gracefully handle an unexpected state resulting from invalid configuration. In terms of adversary tactics, this flaw supports ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via software vulnerabilities. An attacker with limited privileges can leverage this to degrade service availability without needing elevated access or complex exploitation chains, making it a significant risk for multi-tenant environments where privilege boundaries are critical.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Administrators currently affected by this issue must identify the specific VMI resources containing empty ephemeral volumes in their cluster and delete them to break the crash loop and restore controller stability. To prevent recurrence, KubeVirt maintainers have likely released patches that enforce stricter validation rules for volume definitions during admission or reconciliation phases. Users should ensure they are running a patched version of KubeVirt where these input checks are enforced. Furthermore, implementing network policies and strict Role-Based Access Control can limit the blast radius by restricting which users or service accounts possess permission to create VMIs, thereby reducing the attack surface available for this specific denial-of-service vector.