A critical KubeVirt auth bypass and an Apache Kerby pre-auth flaw headline today's moderate-volume bulletin.

CVE-2026-13325 — A critical authentication bypass in KubeVirt's migration settings exposes the virtqemud proxy on all interfaces without TLS. The DisableTLS migration option, when enabled, strips authentication from the migration channel entirely, allowing any network peer to connect to the virtqemud proxy. This grants unauthenticated access to QEMU management capabilities on the host, effectively bypassing all intended security controls around virtual machine migration. With a CVSS score of 8.5 and high risk rating, this flaw is particularly dangerous in multi-tenant Kubernetes environments where KubeVirt manages workloads across trust boundaries. No known exploitation in the wild has been reported, but the exposed attack surface is severe enough to warrant immediate review of any cluster using non-TLS migration profiles.

CVE-2026-57915 — Apache Kerby suffers a Kerberos pre-authentication bypass that allows attackers to authenticate without valid credentials. The vulnerability lies in how the server handles unrecognized PA-DATA types during Kerberos pre-authentication, effectively circumventing the entire pre-auth step. Successful exploitation grants an attacker access to Kerberos services without needing to prove identity, undermining the core trust model of the authentication protocol. With a CVSS score of 7.3, this is the most impactful of two Kerby CVEs published today. Organizations relying on Apache Kerby for Kerberos infrastructure should prioritize patching, as the bug directly enables lateral movement within Kerberized environments. A companion issue, CVE-2026-57914 (CVSS 6.5), enables denial of service via deeply nested ASN.1 structures.

CVE-2026-46601 — A denial-of-service vulnerability in Go's image/webp package allows remote attackers to crash applications processing malicious WebP images. The flaw is triggered by a crafted VP8 chunk that causes the decoder to enter an infinite loop or exhaust memory, depending on the specific malformation. Given Go's widespread use in web servers, CLI tools, and image-processing pipelines, this vulnerability presents a broad denial-of-service attack surface. The golang.org/x/image/webp library is a dependency in countless Go projects, meaning a single malicious image could bring down services across diverse stacks. No evidence of active exploitation has surfaced, but the low barrier to attack — sending a malformed image — makes it a likely candidate for inclusion in exploitation toolkits.

CVE-2026-54679 — The popular JSON-processing tool jq contains an integer overflow and buffer overrun that manifests on 32-bit systems. Attackers can trigger the flaw by providing a crafted input file that drives jq's internal counters beyond their maximum capacity, resulting in an out-of-bounds memory write. While the moderate CVSS score of 5.5 reflects the platform constraint and the need for local input, the attack is trivially executable by anyone who can supply a file to jq — a common occurrence in log-processing pipelines, CI/CD scripts, and system administration tasks. The bug does not trigger on 64-bit builds, limiting its real-world impact to older or embedded 32-bit platforms, though many containerized environments still ship 32-bit base images.

CVE-2026-13434 — A second KubeVirt issue disclosed today involves unvalidated tenant network names in the Multus CNI integration. When the ExternalNetResourceInjection feature is enabled, an attacker can inject arbitrary default-network annotations by crafting a networkName value in a virtual machine instance spec. This allows an unprivileged tenant to attach their VMs to networks they should not control, potentially enabling lateral movement across tenant boundaries in shared Kubernetes clusters. The CVSS score of 4.9 reflects the requirement that the ExternalNetResourceInjection feature gate be turned on, but where it is, the bug effectively nullifies network isolation. The two KubeVirt CVEs together paint a picture of an environment where both authentication and network segmentation have critical gaps.

Five Cacti vulnerabilities were published today for versions 1.2.30 and earlier, all fixed in the 1.2.31 release. The cluster includes SQL injection (CVE-2026-40083) via unsanitized unserialization in managers.php, a path traversal allowing arbitrary file read (CVE-2026-40084) through the report format_file parameter, session fixation (CVE-2026-40082) from a missing session_regenerate_id() call after login, an open redirect (CVE-2026-40080) using a substring check instead of a proper host match on the referer header, and a package import signature validation bypass (CVE-2026-40941) that allows self-signed packages to be imported as legitimate. Cacti is widely deployed for network performance monitoring and fault management, making these bugs a serious concern for NOC environments. Organizations still running Cacti should update to 1.2.31 immediately given the breadth of the attack surface — an attacker would likely chain the SQLi with the authentication bypass to gain persistent access.