Red Hat OpenShift Virtualization 4 ExternalNetResourceInjection Beta Feature networkName permission

Summaryinfo

A vulnerability labeled as critical has been found in Red Hat OpenShift Virtualization 4. The impacted element is an unknown function of the component ExternalNetResourceInjection Beta Feature. Such manipulation of the argument networkName leads to permission. This vulnerability is documented as CVE-2026-13434. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Red Hat OpenShift Virtualization 4 and classified as critical. Affected by this issue is an unknown part of the component ExternalNetResourceInjection Beta Feature. The manipulation of the argument networkName with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or sanitization. The only admission check rejects empty strings; no DNS-1123 format validation, JSON detection, or special character rejection is performed. When the ExternalNetResourceInjection Beta feature gate is enabled (off by default, cluster-admin only), the NAD lookup that would otherwise catch malformed names is skipped by design. A tenant with kubevirt.io:edit permissions can inject a JSON-formatted NetworkSelectionElement array specifying an arbitrary namespace, NAD name, static IP address, and MAC address. Multus on the node parses this JSON and attaches the launcher pod to the specified network attachment in any namespace, enabling cross-namespace network access and IP/MAC impersonation on network segments normally segregated from tenant workloads. The ExternalNetResourceInjection feature gate was introduced in KubeVirt v1.8.0 (first shipped in OpenShift Virtualization 4.21).

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-13434 since 06/26/2026. The exploitation is known to be difficult. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 06/26/2026). The MITRE ATT&CK project declares the attack technique as T1222.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• Red Hat

Name

• OpenShift Virtualization

Version

• 4

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion