RHSA-2026:59062HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

Published
August 24, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products22

  • Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:071f6c1caaf82935fb7f0709ec9c03be9dbd64738124e299bc2c17ba8aef827c_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:20c0e046c9329bb64f983bbb3dd49ffa4fbb1b5dd66ea14300cb2a91de98689d_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:965ee691a1112b57688bfa7a2d619449ca0af3af2f460e0db6989009f600668e_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:62f95d0d5f619f1ff5a80410b4ce7c9b217b787bae05a04272f39e4b2ead724c_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:9ca6a56bfd179acaf9e941947f0791906b5f35ea1f2e0f89071a07f553ea0c09_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:fe0ab78d62dc836c3f046ab34c9ed50d3603bd4abfe0e3ad149e6b6f1973662e_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:2382533ee9efe120ee8c0b05827cb9d371de362a6a18ecc0e84948c3064a2ec9_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:3f7160dc2f5b96a293b42cff47e054fc426cd546b597c743984d9e57b8fec119_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:b9a5bcfcc65c85992fb5ff23442b4f709b3c051df57f99c4df3d6f40b75e4290_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:117eef7977c0fda7260fdadc758016e7d60509d322779d0a4e7326576c53671e_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:119979fd6fe89df5752a3b2d4dea463cd787f2ee354f10d66046ab68aa5f3fc6_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:d7d6b4e9ed0c578353be257888bdb8bd91b3afcc14939a82bce2b39e520b53e3_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:0c881c0a7dfdaf03eb897b5a9d7a7d49cd9034a3f02669ac73faddbba67d5c21_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:4fee1fa0df0dadf74dfddb93f038149acf8d603c04f85aea20b97af91520bff8_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:6fb09f2089047cc80fc9fe570817ab0ac3c21309161e9aead552c0a73035084f_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:0987e907d4186e63a8e3a635b25582640efd5ba0ec1a74e0de4255c0bc49dabb_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:113cc14f4c74cbd32ab4aa1b297ef17c7eab63c52a61a57c120ebc8de8bf9fa5_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:2a121e50d354964e7786d8663ae41faf414260ca788cd197bdce430bbf041a1d_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:b60a27c934bdf9ce1413cd503e428272037ef85dfeda6de97e4c9034474b2869_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:c943c6b8213851c7eac79eab7e3ce5d7984a343dfcc2fbf8827aed1d457b0c0b_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:f744a38680946041c530078e94d3709823a29c68815ae46706c96bff7b203009_s390x as a component of Red Hat Container Native Virtualization 4.21

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)