RHSA-2026:53721HighCVSS 8.8

Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

Published
August 11, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2026-13201 →CVE-2026-13622 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:8573a4c014ffbd038501cfc93d1f8d48fadfc142b59524e953ec192ac4feee22_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:d755073e64de7b98b45f015e1220b4e0df3dc60df7d3e290f127ef906e490e5e_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:99477e2f0d3b21475fa1b324a783ac10f86c5a0df21c71015f5b107024eeaf03_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:d12b841c94aa67e6d28fe0ec5563ae46e2cae568c122c1bcaa1a5d3bd7099bc8_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:f3195961936617043a8466764c7640881905e886ab45748a8c0a8bc3805377a0_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:fcaa518c0f900f9d2f205623c7d9ba6279ea8f16612ba533f34c4c9d04d848f5_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:3fd846a3b98b069bc6ca367d7a70618db3f1a6e604963a32a4d1cb762b6f6ec5_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:ddb739502dda369d7dd96dd3c5f141a727ef005f662cccaaaa3857d44e198260_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:0f5e8f086d5570065c7fa67f06ff7b91d80f7b2f691a65426abfb4d07dbc0a07_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:bf33e91d3702b51bdd4aace175a5b75917298daa7a62fc53072db1f4ee985bfd_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:0ee3b49ed2db55663fba7ddd01a1de45cade7960cab894bbff3700390d91b88f_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:376802fa87c574378f396b52bcaf59cf822c8da18a3ddfb4b6236183fdb1ae0c_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:370987380c06c5ff14f6618002d85396eee4914635fd8a6cc45152496f0e03bd_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:4e4b8eedb3e7b5c7b20a208f27a2be5f2eb1349ebbcb5b5e4f450e2bc85fcdbe_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:4d882c88d873bcdb303d36f0304f664c9901045d159c5b31dbdd1b4c7deaab63_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:7b25a80d802825b1098832ffd61c4c263afb3f94d1177c43a0baf47bbb965b15_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:204cb4bfb3972f272c036127dfb1e4272c2c693fa1c95702bee8104a184820e3_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:2a4c4779a8c4c6e505125b4345819fd3e966074c3233e697cca3509b4d59da82_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:02664c718f2eb538756442aa6c1d0740bf469258806e4c4ffbf0c8d50717bbd0_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:17e3508a5dea71d53caba4c640bdf4594faa9246e7334d910cffdc114b1f9e85_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:4da7d81d41ffe10f56101bfee5eabb709dd842f754e441ac3d66b74223834c63_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:a77a31ac0ea21a8475e1548863c2f7a264dd04b98133d749da285e5163f882c2_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:31d95fd911600429e52bcba262e8416f247f4eeba4c093aa2282e1952949b884_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:6672bbcc5bab9b6935535115ebe34e119bc33e653149c838924bb3563292bb8a_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:6543d8dbb39ee8f862175d2a463c16df01f3b3b096f624dd3a8935f69003aaff_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:e6597bd7b91a962cc33f6729286885bb8e8de50d7feb5e9bbe081ec9a96e5501_arm64 as a component of Red Hat Container Native Virtualization 4.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability. Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.

🔗 References (5)