Publish GHSA-7jcp-v9w4-wjmg

Author: advisory-database[bot]

…-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.json …-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.jsonadvisories/unreviewed/2026/05/GHSA-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.json renamed to advisories/github-reviewed/2026/05/GHSA-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.json advisories/unreviewed/2026/05/GHSA-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.json renamed to advisories/github-reviewed/2026/05/GHSA-7jcp-v9w4-wjmg/GHSA-7jcp-v9w4-wjmg.json

@@ -1,80 +1,155 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7jcp-v9w4-wjmg",
-  "modified": "2026-05-28T03:31:15Z",
+  "modified": "2026-06-30T18:04:04Z",
   "published": "2026-05-26T15:32:10Z",
   "aliases": [
     "CVE-2026-7374"
   ],
+  "summary": "KubeVirt has a Link Following vulnerability",
   "details": "A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "kubevirt.io/kubevirt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.8.0-alpha.0"
+            },
+            {
+              "fixed": "1.8.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "kubevirt.io/kubevirt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.7.0-alpha.0"
+            },
+            {
+              "fixed": "1.7.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "kubevirt.io/kubevirt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7374"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20720"
+      "url": "https://github.com/kubevirt/kubevirt/pull/17916"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20736"
+      "url": "https://github.com/kubevirt/kubevirt/commit/011eef8129e2c21e0ea496f283ee1676009bc757"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20763"
+      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7374.json"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kubevirt/kubevirt"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20767"
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463728"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20782"
+      "url": "https://access.redhat.com/security/cve/CVE-2026-7374"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20825"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20975"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20866"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20890"
     },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:20886"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20890"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20866"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/errata/RHSA-2026:20975"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20825"
     },
     {
       "type": "WEB",
-      "url": "https://access.redhat.com/security/cve/CVE-2026-7374"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20782"
     },
     {
       "type": "WEB",
-      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463728"
+      "url": "https://access.redhat.com/errata/RHSA-2026:20767"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:20763"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:20736"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:20720"
     }
   ],
   "database_specific": {
     "cwe_ids": [
       "CWE-59"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-30T18:04:03Z",
     "nvd_published_at": "2026-05-26T14:16:40Z"
   }
 }