RHSA-2026:20767HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products40

  • Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:2d50b3d714d56c94b0123a619f68796e9ff0e38fb26c43f7ed276bc379a92999_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:93f5f6abaab5bb353bc473d1c7acf3ab95f7656a0b907799e4573ba9e727272c_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:d51d41a403ef83836dae966cea91fcb3f2ccd1afa3eda6b177796f75059ab157_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:14f5b351ef59b71822e2e3d2f42f98d892ddd7700fec77b8540a38f71ce51379_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:16afd6d6f78fbb9b4113f3c0467d34e1b4c0b093ba206453c9a5d0f37009d810_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:1c9aa48a4f3f8e78439263e3403741656cb91d5c3ad8b90ff7923ac4c7ba3888_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:85bea46040e02934e6878ee62c427620c0a318b85fb7c57a581938b8307f5998_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:d281686bcced8fade9b65aae2a3d0b29cda7a2368c864f5f528f03e54c4328be_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:fc20e84d5b79fe5f250a8055b78680306369f77f86c27601b83855a61cc8081d_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:00de676d2adb05793627b03f3d2313b512bb5eb379539b97d114eb5940494799_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:dccf7fbdf0a3ae15eb197ba5cfdd7b872c90a02cdc59b8047275dc7d223324d5_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:ef9e04c168c9cdd67fccc5d57d86f9e6ef18f1bdb0e09226856931a72129fc86_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:c48a51750ddbe8e9f99998061234ec65a76630bc4a86482121ea90587815f398_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:f2d09e444e9bf98129086a3e137ee1c0e78ce71e2ffdcf52751f28214f9e5283_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:f471c96826ba9945ad149bb369f25d6da2dd6fb8dbcd66698124c1c94eb233e3_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:57bb2b1f163e00406d7d9aaff6eb976a9b96a881957741b53fc3c699dd3c6211_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:ce71953b102bbf2710ee222806752fa1e02f220c24eb99caa307492ddffeb2c1_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:da7b2a2cd032b39667082d4823bac63e740d6bd4ccc5f15250d2c646ec81fa94_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:1df638821d37d1abf94d8399ade3543517381703a8e3378c129d9664e0c085e5_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:d254039d186a61a7ae855188834e5fffb6c5ca7eb56cbcb4c0fd7c6ebe22d8b4_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:fac2e278ac5f2847409f6f0a2a8b8fc71827a162497148691adfe026d85b2466_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:84f3368c4b1dfe5d7e5462c3c859f828af5a03e1a7936e2a96801856fe467d30_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:a6e8c0e2dd6a832a0ce350ea5903f68ccc79a462770793f481befcb62a9d4f18_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:d9b617f821433b8605d0fbccb896894ff78cd66fc1ee8aefc739309d5516eed7_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:954f07f4ed777b1af124766ebbbd7759651b2904a5dd898feafd139ec1d30ff4_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:a28f0971b82e4a535336adce276086999cb2ac142621a50c42417df3edfeb6c6_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:b48a690cc258adc14902af10ec65e11318a554ac427133d3e0dd54f18981db5c_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:3a74de59a7a529c450a6aff78697d87cb79c0ae76a13c748dbb6b7fcb491d2f3_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:74fd74a15dcfaeb3dd524f7c599aa5a271cfc4c7cc7c59117cac35ada4cfc3aa_s390x as a component of Red Hat Container Native Virtualization 4.19
  • +10 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)