RHSA-2026:53684HighCVSS 8.8

Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Published
August 11, 2026
Last Modified
August 16, 2026

🔗 CVE IDs covered (2)

CVE-2026-13201 →CVE-2026-13622 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:0f7b268d79ccecc06972a0d130dfcb1f62cb16af2117f00277e1e06cd5698593_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:1ced8552c6490cf157d5f1b04807bbd6f38e28caa91345e02d52251ae5a9d86b_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:48a3ae4f6fb550ef60a4b1779a5f8b17951275fa7628380b60a214b0d760284c_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:571318d7252d4538201550b413488962599c6e369be98f0de70c515fefc478ba_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:bef3c8b24ae6b84c02b24b3a2dcf12be3cce02edb0761d212fa73fc691ded4f6_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:f5783d12d920eb84c0f1e4b917f497b9cd3eb3c45b6369ba6e0458e5750d64c9_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:29ffc663b8550d71b50d99b5a71d7eb572b3164d40a9ba93edb057d49582f7c1_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:a5e42c554e62bda46d4deb5238e9bd80fd254dc0ef43f329586dc2063074ebf6_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:239f284402a2e62a2d2cfb2626461e6006cbace18b71607c9f35104901f65c17_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:ff49ea5f5066440b685de7dd0dc56971384d9952677da94e388da8347a91718e_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:00e74f253b404297893bd98e555b582d4344d21bebe090b3638b7708840bf9fd_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:15897d5570175de6f2e20d514aa3e35b17d1066566eed98d223e35cb5a3e519e_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:1e6c6d044a4d66062f7dd9fb243a9c0a78f4c5ea06e0a8821b882e9474df0185_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:7ec0347ee1ddff856b5f0cfe3bc7912cc5dcc8aa84368f6cb6684ea692b42d71_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:989dc63abf3314849e42b37fb87cc25f5a51a56fd35ee3a6803a0fd91cc22508_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:9f8275a5708e0aaf1a63e4468b5b5c8042b64ccce06fa992705b014674eba592_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:19d5fff928d01c556458f71296bd23fbdf76f088e33f38b1614ea1451ee65af7_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:4d5c5d09d058cc855926a1ebc4ffd06a370bf45efa515a68149794815bcff80e_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:5c84fa2f9ace9a23af18e7c91f08fe619e677bcf65ae09799308bbfba09424ce_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:df975f8c629ce878e41c4c7821346391190014312dd397aa99acb32467da8023_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:1319d17552e1aaf3c8df3811d14152ff109ada7e169615b88b57761b0f7abc14_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:23d9beaf92c0db3896b91b77d31efdc429b74e27a6a46097e7b3cf53afe7af19_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:d26d57f08b39010311f0ba26965167b4ffe69f1f1a6b0bfa9fc2920353eabdbe_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:e4c66a5dfd5f70c01020d5585ec4f6f15d69530fb5106fedad55703cae0a9873_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:46ab024565a3033fbb02d9df16eb29a357c0bd97832210ad8324e6d416009026_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:63389b89c1d5c9f82d02f0c54404e137cdc74e5b1e4ad3d10ffee5c795cae721_amd64 as a component of Red Hat Container Native Virtualization 4.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability. Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.

🔗 References (5)