CVE-2014-0028: libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:sea...

Security readout for executives and security teams

CVE-2014-0028 is an access-control flaw in libvirt. Certain event registration calls could bypass ACL checks meant to restrict domain visibility, allowing a context-dependent attacker to learn sensitive virtual machine domain object information. The sources do not show code execution or active exploitation. Exposure is most relevant on virtualization hosts or management services running libvirt 1.1.1 through 1.2.0 where libvirt ACLs restrict domain discovery or attributes. Environments without untrusted libvirt API clients are likely less exposed. Prioritize remediation for shared virtualization platforms, hosted environments, or delegated administration models. The business risk is unauthorized VM metadata exposure and weakened tenant or role separation, not a sourced remote takeover. Mitigation focus: Inventory libvirt deployments and identify versions 1.1.1 through 1.2.0.; Apply relevant distro or vendor libvirt security updates.; Review Ubuntu, Gentoo, openSUSE, and libvirt guidance for fixed package details..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.