RHSA-2026:27901HighCVSS 9.1

Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products7

  • Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:000bc72922c1cde56c5a31da18e816dc1fcaef66e8788166172ef3cf67c00f59_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:2ee75a575fed2549a1a3c04d5683ca6d2311fd60bd8868e18486b9d223e1ed0d_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-csi-driver-rhel9@sha256:c0a28891b65cccd70ecd73ad4a05c771778dd1d25f7bbc6f61f3abfc35d81109_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:149605a96859067cffa3d33be96a2397b802759db8df26ecfce510513a78add1_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:239587208accfd0130884ce46f947a580816be484569c3166110e2ec1e6ad2b7_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/hostpath-provisioner-rhel9@sha256:db35cbefa8e8ff62d1e6fd54eceade3d66971f0f2791bb7b9d02f02b1b466279_amd64 as a component of Red Hat Container Native Virtualization 4.19

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)