RHSA-2026:27893HighCVSS 9.1

Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products7

  • Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:0b946e36b1480c68b9016b7ad6ee785c68bab137595ee44ce20471cd4b9b132b_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:edfb4a17b61cc7471c9ef1207bcd5b46384d5a02562906e7d169132e41836af6_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:f1e1d2d866c2a14e921a9f07dae3e0a02fd260d924c86dae67092e3b6c9e0b27_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:15e2fb3849c5f4026a072a1271385c2eea753e293ed7923c1968496a26477d70_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:45db9786003fa468897b72001873abfb62bf728898896b6df2cefdc747190df4_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:6e9c1572783151e6851e3c242ec5f15fb6a5b24e58b297e8fbff1461bfbf7c22_amd64 as a component of Red Hat Container Native Virtualization 4.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)