RHEA-2026:53670HighCVSS 8.8

Red Hat Enhancement Advisory: OpenShift Virtualization v4.12 Images

Published
August 11, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-13622 →

📋 Description

CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

🎯 Affected products10

  • Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:5c0fe47c22b92a32d7779ea5c7707a4fc74aebbe04b852e27535983f6fa2667c_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-api@sha256:2872ea0e0ac41a1419e31341909f64c4420fdedf96e504928e087ac017ec7323_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:4882a54e614fbe8d79f71845a64ad74d128c8355fb4d824974b823a3d1468eb7_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-controller@sha256:817da590f3b5c4054a8b190cd1eda971dafea465a10c8f5b0e3db2fa4e0d444c_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:6b1ba5980098dab51cc53f62bf6f96dc9971d48d949057c231f65ba70217fbcd_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:81f9e77dc20eaceabb2cfaca627002adc65136d7a08c6837a3b259b9ac417d27_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-handler@sha256:97a474d86d9e3907a0c16de48d0d13e43c0cf2f22161ea60c6df19e37c519df7_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-launcher@sha256:52938c4bb6f73c485db89bb3703a0499fd2cc969e29e2f7587d43447725cf396_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-operator@sha256:f64afe86104f04f0cab7fa3c489c6939b5bb92914d50341cb2f656cea7eb298f_amd64 as a component of Red Hat Container Native Virtualization 4.12

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.

🔗 References (2)