RHSA-2026:20763HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:2d2c0bfd13946c66236272cd5d7cf198abb3ffbf39217588cd542eff760722bf_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:67cc4a2ef399e9572a6252cedc3b42dc6f1155e9b7de7c0061996346995ce28f_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:1d23948d31fd81384bcf01f5a13012b1b619077f2d0aced7fcb8722c0964a814_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:66222b95d48be96b5d9cce63fd2933bff57431b0edb2a71f854ada49fc925495_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:6dead140ee37593e5eff3bff925b8ac43f0a195505692f29e80c01733cdf7152_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:f60d1705981b3e4b7980fe4a0ef83beb2db983fc09200649301122954b2ef192_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:47d6bfa75b19fbf6ecd4023e380227eee868d90b95e550cd3fa26cdee5a7d9f5_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:b6b4f4d0bac4f18a023ccd5e220de6f915e804a812fe971ea18157e74a407afb_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:da024dea0672d4b7476b7e64f8f8156ad0b27b8796aed8cbe7014667050bf6c3_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:df0a656449b5f51d7eb6e83b1c5cf23c992f5ed239d7fa9f4c0ca92b4d71d30a_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:1b9072b05bc6c2afd1c4d64a1b65bae999e6598c8dd2d7bebc5065bcf6f73cb2_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:bb99cc0de1e0970e83742b0f417afc1b87799ba0a529b7db669d13e5552d8968_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:7f08385a74fb246b3c0f5ab51f33f94f96dea0dc0022faacd455543828e7c4e5_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:e88db5281c7b9d8916edd889a49364e814b9c1533b068aaec3b56106b93b57b7_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:7d0946909713e52c32169c255dca73c588a9de2d24583b683b4bbf172bf848b7_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:7f51e6903dd1b5c7a115a239ae81e9279283580576e7a67595dbff2bc9be4a86_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:03c1cb7e689a680c3ae11c6bca67ed6cdf9c41c73e82afc6a00aa5350b52ccbb_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:39669b642ade3ad78b6f8679ead3c81e8e0f292195feb08adc328898c37c9eba_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:0a9b84aa699dda911cd407b5b7f1d65760d8c60bcf5f368dd6fa21cc503dc46d_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:cc6783b9433cefab6547c96f7e0dfc36efc3e453ffb22a7ded5ac1974f4fb499_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:72cf5ccb119c366afd5e03cd30896520c904a6a5185763023a2cb0dbe51781d8_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:e8f5225c3db3dd59b8b97c45b653f06d2569a050d9f0269cbf3379e9bbfd7492_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:b77ea89568c5cf1c6e840a81d533b5ebfadd92e494d2b351d6ad6c44227ef003_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:e89bf5e9978db47b54a425587cf7c3b037d6fd293256e9bc3f0373daf8fc7241_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:a0ae3ea3c59d4f189db05412a3e9b0913396aeaf86d548ca63c821d96e9ac933_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:f838fcc8f14d75977cbb2108ff7648131b6745bb6565d4fe962184f2050dae01_amd64 as a component of Red Hat Container Native Virtualization 4.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)