{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.59.0"}],"component":"kubevirt.io/kubevirt","cve_ids":["CVE-2023-26484"],"ecosystem":"Go","epss":0.00611,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-cp96-jpmq-xrr2","id":"tcs_01M5KF7MH4BM0GN1AFNV73HSQQ","modified_at":"2023-11-08T04:12:02.023010Z","published_at":"2023-03-16T16:04:42Z","references":["https://osv.dev/vulnerability/GHSA-cp96-jpmq-xrr2","https://github.com/kubevirt/kubevirt/security/advisories/GHSA-cp96-jpmq-xrr2","https://nvd.nist.gov/vuln/detail/CVE-2023-26484","https://github.com/kubevirt/kubevirt/issues/9109","https://github.com/kubevirt/kubevirt"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-cp96-jpmq-xrr2","url":"https://osv.dev/vulnerability/GHSA-cp96-jpmq-xrr2"}],"summary":"On a compromised node, the virt-handler service account can be used to modify all node specs"}