CVE-2020-1701

mediumpriority · track · 26EPSS 0.007 · 55 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.75% (55th) EPSS
CVSS 4 · medium
Is it mine?
6 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedcontainer-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHEA-2020:2011
  • Fixedcontainer-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHEA-2020:2011
  • Fixedcontainer-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHEA-2020:2011
  • Workaroundcontainer-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    This issue can only be resolved by applying updates. Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundcontainer-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    This issue can only be resolved by applying updates. Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

  • Workaroundcontainer-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64 as a component of CNV 2.3 for RHEL 8redhat_csaf

    This issue can only be resolved by applying updates. Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

02

cvss

Technical severity, 0–10. One row per scoring source.

6.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8 · impact 2.9
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV
v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-732USCWE-732USCWE-732US
04

affected products (6)

Products and version ranges known to be affected.

05

advisories (3)

Vendor and ecosystem advisories describing this.

  • RHEA-2020:2011Red Hat Enhancement Advisory: CNV 2.3.0 Images2020-05-04csaf · redhat_csafUS

    Container-native virtualization release 2.3.0 is now available with updates to packages and images that fix several bugs and add enhancements.

  • GHSA-849r-8wvp-4wwgPermissions bypass in KubeVirt2021-06-01ghsa · osvUS

    A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.

  • GO-2024-2765Permissions bypass in KubeVirt in kubevirt.io/kubevirt2024-06-04vendor · osvUS

    Permissions bypass in KubeVirt in kubevirt.io/kubevirt

06

also known as (5)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdredhat_csafNVDCVE.orgMITRE
published 2021-05-27modified 2026-06-17
08

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan