CVE-2025-64436: Kubevirt

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.

Affected products

• Kubevirt Kubevirt: up to and including 1.5.3; from 1.6.0, up to and including 1.6.1

Published 2025-11-07. Last modified 2026-06-17.