RHSA-2026:53838HighCVSS 8.8

Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

Published
August 11, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2026-13201 →CVE-2026-13622 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

🎯 Affected products40

  • Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:08b2df727922f4686e96904025438da19f063b8702b513d5ac56eddbfe49f726_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:93640ab496e57e25e844d87bc6ba6e23223930d97e8fd24de60872e3ae032431_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:f23de5c9aa7b1321b18beb09a8c8673ac863ed83ab31cc1c1858da146c6453c8_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:3791ca291d192a46d5a77fb55d197d29472d6527e72467501bd1c40f541c2b20_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:a2add52c5076111680a5af97488400bf29284925d869d41c8680832f079a0191_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:f75128fc06e90382c552d79fd0a7647c01bde4dc6146dfc4be17441a384db064_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:4f8e5093c6abb175155387a11643d823d47605f90ae2eac180d83716a91bfe31_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:d2c763e7e1ac8777804c4551c092ac570245e8c769046f24fcfa7a3cf274f78a_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:ec52ee97d651b71c29d44b27c3231c74e6f6c86e797b9691e44285631fa95efd_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:0a837479c4c1c275cf9cb2f4829217ef5ef0b66cfc9e13b3d6daf99db935e41d_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:71ce256e623a0f807a73272ed078915639a90bbccea5a8a32ed8a8ca089554b2_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:98c3cda8ffc6845914cf84c8e20a9931aaf136ffdfd0df8dd64620157ec86ae4_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:1a13724bb41e82e0ad190009b33393ea3daa54aea3b3ee28d9e0d1170b67fb56_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a33492977f605a8ce33d217ace686605d23517aaa68fe0a6039b63c110b7230c_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:c0473ea331305ba085ed27eb70e81cc5ceffef7f9b47292febd79e7ea0dc5740_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:6f2e5919a9655cee2837d923095234cbf71e9be7c086da6f93d50e191b2cfe50_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:912888829b05e068ee5bc90003bb1031917d5943da6ad243f8ba20a568e765d3_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:9b56aec3c9c7c09ae9ba5e3eb87140de415cd669a6d234f34d9976b048581939_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:1169719a5ea230596cc5a4447fea9d5979d764619ed824ead0cba19bee4d8e3c_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:a2246546c249dda83d1a033021c4bc097d0bb29c0e5a45cd5b4eb042a90af2dd_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:f326c07e78e8ab14f0c29ceb479430d146d53b66b96534ea17d1b1456361462e_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:339de7fa25a617a384a58f24d93cf5582654e5117851b701c78d383221cc7e4f_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:606decff14a8d70e316ec8658e96572f64dacee61e22f4c622844a1cfe9f0954_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:f2197cf290dc5631b74bbeda953a1e7e2b47dd11c3b6bef370bbee01927bee4b_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:3e3860eff071c3e10ab26d1477a3c3ed122b2128eb3764a0da0330211d8707ae_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:c96eb8f1fc13aef7379234e0199dc1dec7c04236d2a26b051f543508d302c6c6_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:e19b6ad2363d1d43a2fcc215a3d176acc3d86a4c9a5ac6b175dcc30ced35c4e5_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:7ba8ad75369db90c48a0b3015acaac63ac534f3b7d7ee0660de2f8429f3fee46_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:7c33fad0db7acc2ed55c8fa9ad556124f7663bc175b76d545a9fbad07ecf3a8a_s390x as a component of Red Hat Container Native Virtualization 4.18
  • +10 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability. Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.

🔗 References (5)