RHSA-2026:20720HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products43

  • Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:2361d1b06eebabf0f10de8df09e87ae93a3a100214e9df71ccdeb72e9791b6c2_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:27b1540616a57d67ade5268b3076b7fcb006d4f79181fb489f997f57539b57ac_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:fd6730b9607b311cdf56f2802d0af9b34050e1eb00a593a893327a226935a704_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:160048570be8b055cba528d80ef2ce5ebeb7d4fe5ad2648ee0d9f04f903e2592_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:4c0e089c9097e601f5e423ee8c9e0d2511bf7c964e0530d2142e00b681d1815a_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:5c42d3d7ff0014564f58e46243591d69823eac30afe6cc9c55a3ec0c5bd5afd0_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:9329eb8a3f2f313e4dec781da9cddf89d6db6399c623592bb22db99e4a7b6ea0_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:b46b11eb5413308b606eccec24aa9e9b7cf6b0eb6162d886d474bb9f9d6ce6e6_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:be82f37caa29280d2fc25a09d6875c18e8fec33070e2998d3b68eea10ceca267_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:09628db8f7a51709ea24bd97398773656d67c4f32bd839262ab7441ac98cb64d_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:38eccf3096f77495a1cf52f6b0e2bb583680087bfe08d1b84d304e6b52621500_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:c5f9fd9904bc675494081963f7ef102239a15cb91f21e7f8caee380b19f7991f_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:401974fc8dc6e918d42f36d4aa1abd2701af56c21658ed37a2382387000064ff_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:6033c3275bc089f51c0e03cac1cc2c67817800ade64cbd9ad1d243aebb105a42_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:73ba8dbed39eafc02493189b832bc208b0aab9018d5475bc1c8f4526e03a3892_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:2efd21bbfa495c7ffb955c9dd075fe8086c424429657dd1e04ac11504a9b0866_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:6451b447204e4671e3517387a4301f0d805323e1a0366c7810fe41ffd87095d5_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:d0908ba7a260a00b0c914e4865791a93c2a9aa99d00383685ce991b8843ab71b_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:93782bba46372288bef4c9eda47e7a61180db79fac2c9b0cd22a460525836c57_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:b345ee7321aeec71912a8cc19389f7c72e5bacdb21f2ac96fdc272d80d106451_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:e96b36671655dab9fbacdec4f56dc7b669754ea626408a25557e7351ea65b326_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:44e60e22aeef4b8498922084c4b39fa4ed052182b0d02969fd0d9a0b7b59166d_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:64c4f4c13110b1b08a44a479f2bf13063743a800ac0e07d25e28f9b1643db5a0_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:bc9c49ac67612160b47a03746482ea5e9bd136dc569aa1e106108dbb013794fe_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:5c918fcc3712e50e7bb25cfb28226e58c92737bb52de8b79c61e0545fdc53d53_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:be4e0f785be827e1d254453a122cc50643712e45d952070c35ff804966e52394_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:ec9d69ceda8fce1b46199bd422c0d9d5195c0b66051a43fdab35d749fd417b97_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:0d221969988bddd2be101764ffa0db20e94901ee28ed26a3cf7c1156868a28d1_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:5a37eaa44063f51692f80acae86e0974bef1fc97210a63572d96de92a8eb7793_s390x as a component of Red Hat Container Native Virtualization 4.21
  • +13 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)