CVE-2026-122224
Description
A flaw was found in WebVirtCloud. Missing access controls on virtual machine management endpoints allow authenticated low-privileged users to manipulate or delete virtual machines belonging to other users. By submitting requests directly to unprotected REST API (Application Programming Interface) migration and instance creation endpoints, an attacker can disrupt existing virtual machines and provision unauthorized storage volumes and domains across compute hosts.
Statement
This vulnerability is rated as Important severity because authenticated users with minimal privileges can remotely compromise virtualization host integrity and disrupt workloads across tenants without requiring administrative access. The flaw allows unauthorized manipulation of guest domains and storage resources across the hypervisor management plane, posing a substantial risk to multi-tenant environments. However, WebVirtCloud is not packaged or distributed within Red Hat Enterprise Linux or other Red Hat products, and standard Red Hat virtualization platforms remain unaffected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce administrative permission classes across Django REST Framework viewsets to block low-privileged users from VM migration and provisioning endpoints: upgrade to the fixed release, which enforces IsAdminUser permissions across compute, storage, network, interface, and instance management endpoints and scopes instance queries to the requesting user, closing all 3 injection vectors (unauthorized VM migration requests via MigrateViewSet (/api/v1/migrate/), unauthorized instance and volume provisioning via CreateInstanceViewSet, direct execution of VM lifecycle actions via InstanceViewSet). Until patched, this is a concern on WebVirtCloud deployments with network-accessible REST APIs and authenticated low-privileged users, so Restrict network access to the WebVirtCloud REST API and limit user account creation to trusted administrators to prevent untrusted low-privileged access. As a compensating measure, Log unauthorized or unexpected administrative VM migration and provisioning operations invoked through the REST API to a central SIEM for detection. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-907 Application-Layer RBAC Enforcement (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
