CVE-2026-13218

This flaw affects OpenShift Virtualization deployments where virtual machines are configured with bridge or other non-masquerade network interfaces. The default network binding mode in OpenShift Virtualization is masquerade, which does not trigger the vulnerable code path — exploitation requires a cluster administrator to have pre-configured a NetworkAttachmentDefinition with bridge-type binding, a condition beyond the attacker's control. Additionally, the attacker must have exec access to the virt-launcher container (not merely VM guest console access). The file content written by the exploit is constrained to valid JSON following the network cache schema — arbitrary byte injection is not possible. On OpenShift Container Platform, SELinux mandatory access controls in enforcing mode restrict the set of host files writable by the virt-handler process, and base OS binaries under /usr/ are protected by RHCOS read-only ostree layers. However, host configuration files under /etc/ and data under /var/ are potentially reachable depending on virt-handler's SELinux context. Red Hat rates this as Moderate impact because exploitation requires non-default network configuration, container-level access beyond standard VM user privileges, and the content constraint significantly limits the attacker's ability to achieve meaningful host compromise.