CVE-2023-26484 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-26484 Interim 1 24 2026-03-05T03:46:09Z current 2023-03-17T00:16:05Z 2026-03-05T03:46:09Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-26484 KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-updates/2023-April/028964.html E-Mail link for SUSE-SU-2023:1967-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Server 15 SP4-TERADATA SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 openSUSE Leap Micro 5.4 openSUSE Tumbleweed kubevirt kubevirt-container-disk-0.54.0-150400.3.13.1 kubevirt-container-disk-0.59.0-2.1 kubevirt-manifests kubevirt-manifests-0.54.0-150400.3.13.1 kubevirt-manifests-0.58.0-150500.6.3 kubevirt-manifests-0.59.0-2.1 kubevirt-manifests-1.1.1-150600.3.6 kubevirt-manifests-1.1.1-2.7 kubevirt-manifests-1.3.1-slfo.1.1_1.3 kubevirt-manifests-1.5.0-150700.1.3 kubevirt-tests-0.54.0-150400.3.13.1 kubevirt-tests-0.59.0-2.1 kubevirt-virt-api-0.54.0-150400.3.13.1 kubevirt-virt-api-0.59.0-2.1 kubevirt-virt-controller-0.54.0-150400.3.13.1 kubevirt-virt-controller-0.59.0-2.1 kubevirt-virt-exportproxy-0.59.0-2.1 kubevirt-virt-exportserver-0.59.0-2.1 kubevirt-virt-handler-0.54.0-150400.3.13.1 kubevirt-virt-handler-0.59.0-2.1 kubevirt-virt-launcher-0.54.0-150400.3.13.1 kubevirt-virt-launcher-0.59.0-2.1 kubevirt-virt-operator-0.54.0-150400.3.13.1 kubevirt-virt-operator-0.59.0-2.1 kubevirt-virtctl kubevirt-virtctl-0.54.0-150400.3.13.1 kubevirt-virtctl-0.58.0-150500.6.3 kubevirt-virtctl-0.59.0-2.1 kubevirt-virtctl-1.1.1-150600.3.6 kubevirt-virtctl-1.1.1-2.7 kubevirt-virtctl-1.3.1-slfo.1.1_1.3 kubevirt-virtctl-1.5.0-150700.1.3 kubevirt-virtctl-1.5.2-160000.1.2 obs-service-kubevirt_containers_meta-0.54.0-150400.3.13.1 obs-service-kubevirt_containers_meta-0.59.0-2.1 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Micro 5.3 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Micro 5.3 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Micro 5.4 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Micro 5.4 kubevirt-manifests-0.58.0-150500.6.3 as a component of SUSE Linux Enterprise Micro 5.5 kubevirt-virtctl-0.58.0-150500.6.3 as a component of SUSE Linux Enterprise Micro 5.5 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 kubevirt-manifests-0.58.0-150500.6.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt-virtctl-0.58.0-150500.6.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt-manifests-1.1.1-150600.3.6 as a component of SUSE Linux Enterprise Module for Containers 15 SP6 kubevirt-virtctl-1.1.1-150600.3.6 as a component of SUSE Linux Enterprise Module for Containers 15 SP6 kubevirt-manifests-1.5.0-150700.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt-virtctl-1.5.0-150700.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA kubevirt-virtctl-1.5.2-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 kubevirt-manifests-1.1.1-2.7 as a component of SUSE Linux Micro 6.0 kubevirt-virtctl-1.1.1-2.7 as a component of SUSE Linux Micro 6.0 kubevirt-manifests-1.3.1-slfo.1.1_1.3 as a component of SUSE Linux Micro 6.1 kubevirt-virtctl-1.3.1-slfo.1.1_1.3 as a component of SUSE Linux Micro 6.1 kubevirt-container-disk-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-tests-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virt-api-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virt-controller-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virt-handler-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virt-launcher-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virt-operator-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 obs-service-kubevirt_containers_meta-0.54.0-150400.3.13.1 as a component of openSUSE Leap 15.4 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of openSUSE Leap Micro 5.3 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of openSUSE Leap Micro 5.3 kubevirt-manifests-0.54.0-150400.3.13.1 as a component of openSUSE Leap Micro 5.4 kubevirt-virtctl-0.54.0-150400.3.13.1 as a component of openSUSE Leap Micro 5.4 kubevirt-container-disk-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-manifests-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-tests-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-api-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-controller-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-exportproxy-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-exportserver-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-handler-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-launcher-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virt-operator-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt-virtctl-0.59.0-2.1 as a component of openSUSE Tumbleweed obs-service-kubevirt_containers_meta-0.59.0-2.1 as a component of openSUSE Tumbleweed kubevirt as a component of SUSE Enterprise Storage 7 kubevirt as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kubevirt-manifests as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt-virtctl as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubevirt-manifests as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt-virtctl as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kubevirt as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can, for instance, read all secrets on the cluster, or can exec into pods on other nodes. This way, a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster. The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node. No patches are available as of time of publication. As a workaround, gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node. CVE-2023-26484 SUSE Linux Enterprise Micro 5.3:kubevirt-manifests-0.54.0-150400.3.13.1 SUSE Linux Enterprise Micro 5.3:kubevirt-virtctl-0.54.0-150400.3.13.1 SUSE Linux Enterprise Micro 5.4:kubevirt-manifests-0.54.0-150400.3.13.1 SUSE Linux Enterprise Micro 5.4:kubevirt-virtctl-0.54.0-150400.3.13.1 SUSE Linux Enterprise Micro 5.5:kubevirt-manifests-0.58.0-150500.6.3 SUSE Linux Enterprise Micro 5.5:kubevirt-virtctl-0.58.0-150500.6.3 SUSE Linux Enterprise Module for Containers 15 SP4:kubevirt-manifests-0.54.0-150400.3.13.1 SUSE Linux Enterprise Module for Containers 15 SP4:kubevirt-virtctl-0.54.0-150400.3.13.1 SUSE Linux Enterprise Module for Containers 15 SP5:kubevirt-manifests-0.58.0-150500.6.3 SUSE Linux Enterprise Module for Containers 15 SP5:kubevirt-virtctl-0.58.0-150500.6.3 SUSE Linux Enterprise Module for Containers 15 SP6:kubevirt-manifests-1.1.1-150600.3.6 SUSE Linux Enterprise Module for Containers 15 SP6:kubevirt-virtctl-1.1.1-150600.3.6 SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-manifests-1.5.0-150700.1.3 SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-virtctl-1.5.0-150700.1.3 SUSE Linux Enterprise Server 15 SP4-TERADATA:kubevirt-manifests-0.54.0-150400.3.13.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:kubevirt-virtctl-0.54.0-150400.3.13.1 SUSE Linux Enterprise Server 16.0:kubevirt-virtctl-1.5.2-160000.1.2 SUSE Linux Micro 6.0:kubevirt-manifests-1.1.1-2.7 SUSE Linux Micro 6.0:kubevirt-virtctl-1.1.1-2.7 SUSE Linux Micro 6.1:kubevirt-manifests-1.3.1-slfo.1.1_1.3 SUSE Linux Micro 6.1:kubevirt-virtctl-1.3.1-slfo.1.1_1.3 openSUSE Leap 15.4:kubevirt-container-disk-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-manifests-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-tests-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virt-api-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virt-controller-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virt-handler-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virt-launcher-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virt-operator-0.54.0-150400.3.13.1 openSUSE Leap 15.4:kubevirt-virtctl-0.54.0-150400.3.13.1 openSUSE Leap 15.4:obs-service-kubevirt_containers_meta-0.54.0-150400.3.13.1 openSUSE Leap Micro 5.3:kubevirt-manifests-0.54.0-150400.3.13.1 openSUSE Leap Micro 5.3:kubevirt-virtctl-0.54.0-150400.3.13.1 openSUSE Leap Micro 5.4:kubevirt-manifests-0.54.0-150400.3.13.1 openSUSE Leap Micro 5.4:kubevirt-virtctl-0.54.0-150400.3.13.1 openSUSE Tumbleweed:kubevirt-container-disk-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-manifests-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-tests-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-api-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-controller-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-exportproxy-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-exportserver-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-handler-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-launcher-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virt-operator-0.59.0-2.1 openSUSE Tumbleweed:kubevirt-virtctl-0.59.0-2.1 openSUSE Tumbleweed:obs-service-kubevirt_containers_meta-0.59.0-2.1 SUSE Linux Enterprise Module for Containers 15 SP5:kubevirt SUSE Linux Enterprise Module for Containers 15 SP5:kubevirt-manifests SUSE Linux Enterprise Module for Containers 15 SP5:kubevirt-virtctl SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-manifests SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-virtctl important 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H