A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy.
During live migration, the target-side virt-handler uses net.Dial("unix", "/proc/<pid>/root/...") to connect to Unix sockets inside the target virt-launcher pod. This call follows symlinks without restriction. The socket directories (/var/run/kubevirt/migrationproxy/, /var/run/libvirt/) are owned by the qemu user and writable from within the container.
An authenticated user with namespace edit and pods/exec can trigger a migration, exec into the target virt-launcher, replace a socket with a symlink to the host CRI-O socket, and proxy arbitrary CRI gRPC from the source launcher — achieving full node compromise.