docs: add cve-2026-13622 report

kb/2026-08-17/cve-2026-13622.md

@@ -0,0 +1,82 @@
+---
+title: "[CVE-2026-13622]: virt-handler migration proxy follows symlinks, allowing container escape to host"
+description: This article provides information and mitigation steps for CVE-2026-13622 in Harvester.
+slug: cve-2026-13622
+authors:
+  - name: Po-Han Huang
+    title: Senior Software Engineer
+    url: https://github.com/pohanhuang
+    image_url: https://github.com/pohanhuang.png
+tags: [security, cve]
+hide_table_of_contents: false
+---
+
+A symlink-following vulnerability was found in KubeVirt's `virt-handler` migration proxy.
+
+During live migration, `virt-handler` dials Unix sockets inside the target `virt-launcher` pod using `/proc/<pid>/root/<path>` via `net.Dial()`, without symlink protection. These socket paths reside in QEMU-owned directories that are writable by the `virt-launcher` user.
+
+An attacker with namespace `edit` and `pods/exec` permissions can replace a migration proxy socket with a symlink pointing to the host CRI-O socket. Because `virt-handler` runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem. The bidirectional `io.Copy` proxy then relays attacker-controlled bytes to the container runtime, enabling full node compromise.
+
+## Affected Versions
+
+All Harvester versions are currently affected. No upstream KubeVirt patch is available yet.
+
+## Fixed Versions
+
+A fix is not yet available. SUSE is actively working on a resolution, targeting a future Harvester 1.9 release.
+
+This article will be updated once fixed versions are confirmed.
+
+## Workaround
+
+Use a [ValidatingAdmissionPolicy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) to deny `pods/exec` and `pods/attach` operations targeting `virt-launcher` pods.
+
+Apply the following resources to your Harvester cluster:
+
+````yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: deny-virt-launcher-exec
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   [""]
+      apiVersions: ["v1"]
+      operations:  ["CONNECT"]
+      resources:   ["pods/exec", "pods/attach"]
+  matchConditions:
+    - name: is-virt-launcher
+      expression: >
+        request.userInfo.username != "system:serviceaccount:harvester-system:kubevirt-handler" &&
+        request.name.startsWith("virt-launcher-")
+  validations:
+    - expression: "false"
+      message: "exec/attach into virt-launcher pods is not allowed"
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: deny-virt-launcher-exec-binding
+spec:
+  policyName: deny-virt-launcher-exec
+  validationActions: [Deny]
+```
+
+This policy blocks `exec` and `attach` into any `virt-launcher` pod, preventing an attacker from replacing migration proxy sockets with symlinks.
+
+:::note
+Once you have upgraded to a fixed version of Harvester, remove this policy and binding:
+
+```sh
+kubectl delete validatingadmissionpolicybinding deny-virt-launcher-exec-binding
+kubectl delete validatingadmissionpolicy deny-virt-launcher-exec
+```
+:::
+
+## References
+
+- https://github.com/advisories/GHSA-4336-pf6g-hp94
+- https://www.suse.com/security/cve/CVE-2026-13622.html
+