{"cve":"CVE-2020-14316","nvd":{"published":"2020-07-29T19:15:14.420","modified":"2026-06-17T02:54:31.487","status":"Modified","description":"A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":[],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1848951","https://bugzilla.redhat.com/show_bug.cgi?id=1848951"],"products":["kubevirt:kubevirt","redhat:openshift_virtualization"],"source":"nvd","synced_at":"2026-10-19T21:06:22.076270124+00:00"},"epss":{"cve":"CVE-2020-14316","score":0.01576,"percentile":0.7546,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-828r-r2c8-rfw3","url":"https://osv.dev/vulnerability/GHSA-828r-r2c8-rfw3","summary":"Privilege Escalation in kubevirt","modified":"2024-06-04T16:56:46.447869Z","packages":[{"ecosystem":"Go","name":"kubevirt.io/kubevirt","purl":"pkg:golang/kubevirt.io/kubevirt","ranges":["<0.30.0"],"fixed":["0.30.0"]}]},{"id":"GO-2024-2756","url":"https://osv.dev/vulnerability/GO-2024-2756","summary":"Privilege Escalation in kubevirt in kubevirt.io/kubevirt","modified":"2026-03-03T04:55:15.740404Z","packages":[{"ecosystem":"Go","name":"kubevirt.io/kubevirt","purl":"pkg:golang/kubevirt.io/kubevirt","ranges":["<0.30.0"],"fixed":["0.30.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}