GHSA-j6cv-3w8p-vrg8

Source

https://github.com/advisories/GHSA-j6cv-3w8p-vrg8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-j6cv-3w8p-vrg8/GHSA-j6cv-3w8p-vrg8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j6cv-3w8p-vrg8

Aliases

CVE-2026-6383
GO-2026-5450

Downstream

CGA (106)

MINI (2)

Published

2026-04-15T21:30:18Z

Modified

2026-09-10T03:51:02Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

KubeVirt's authorization mechanism improperly truncates subresource names

Details

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T21:40:08Z",
    "nvd_published_at":  "2026-04-15T19:16:38Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / kubevirt.io/kubevirt

Package

Name: kubevirt.io/kubevirt; View open source insights on deps.dev
Purl: pkg:golang/kubevirt.io/kubevirt

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.8.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-j6cv-3w8p-vrg8/GHSA-j6cv-3w8p-vrg8.json"