CVE-2025-64436: KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

November 6, 2025 (updated November 27, 2025)

The permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node.

References

github.com/advisories/GHSA-7xgm-5prm-v5gc
github.com/kubevirt/kubevirt
github.com/kubevirt/kubevirt/security/advisories/GHSA-7xgm-5prm-v5gc
nvd.nist.gov/vuln/detail/CVE-2025-64436

Code Behaviors & Features

Detect and mitigate CVE-2025-64436 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →