RHSA-2026:53655HighCVSS 8.8

Red Hat Security Advisory: OpenShift Virtualization v4.13 Images

Published
August 11, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (3)

CVE-2026-13201 →CVE-2026-13622 →CVE-2026-35469 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products19

  • Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:02921ca9207b44bf55344a8a645942b65eaa6c87b1a4e6baf23082079baa19eb_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:b09d13552394f6a26667fbfe4b2c4e6759ab6d48eda78369e1604503ee493f84_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:c342cd9c5c571270500fe030a0ea05059513ac92c1163e8fb45259fe9092e054_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:dfac18b969d0327a844173576a61e5167ba6b75d0595e632f4503a2a5ea1c25c_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:37042ca7d80010c3eb3e1822a1f1b9f0dfaa54d7c48715840fc2e972511d389a_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:f3b277354f19bb9f82ccb3b90be4190b163325e3ff7286b021a04c2115f84e18_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:a95be7d69f82bd12291995ebc375b638f8e8c387e9d97f80cc162f92364d4f8f_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:dfea7ba05b0f3a997c53d948c2bdf45bc2e35a2053cf0d54a272fcda3b083c24_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:6eaed5ba9c8f388305754ee0fb6f81990454c31b5d6c89967dead7469f45e11f_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:c8624ab6243671acfffcea28016fc9cbe2dfe1bb7a1fbf943cc066ad547933da_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:2873aade070e6277aa2078a4ff98508b4324564def8a2bd350a924ebfe106290_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:f1a68fe9c75ce3d26037e11304d8b74e8f439faa5d59adf30cdb1b5cf3e591d5_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:1297d4e343e84d5732a2be810ae6e6391fc519c517640db0c84488c5e9861102_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:3666fad9c36b2c0468ea1356558b6125deeab9a3e1d107eae0f14039d0a3614a_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:9bc5e8df15fea13ccedcd4c049d51e3da66a4991e8e21659483372ab24753ded_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:f5a7e4870a7e6483d42f121354cc6d3a162860f46605153112924867ea9357b6_amd64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:0f3e78c868e16e5ad942901efe87a1f834b33416a62f3bd969b8c2ccf2931cec_arm64 as a component of Red Hat Container Native Virtualization 4.13
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:69ee162f3c1bd7c025922ffe7d2e0ea6aca9f5898d84740f0c8d50e1e83fc80e_amd64 as a component of Red Hat Container Native Virtualization 4.13

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability. Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (6)