RHSA-2026:59083HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

Published
August 24, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products22

  • Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:3366951cd5ad15d8ef0aef2769780dff51d5a1b19d7fad23d07e9e275992fef6_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:8002cd33f7b289ce49ed63735bd3712d10c42530f8629e374beb531c948702ac_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:9cb329571f669c4fd1e2fb4a9c7b838e54ba862a340a452e248ca2ae7af63718_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:62aa24623d38bf2cd9372279e11f236bdddab180b81258bddd6e28bd0e74206d_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:66eb1380cef5627805317ce3e87de4800b12363290ced34ef84cbce2a1afd422_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:f5271153de3cf4c4b7c0e38ca9b433d3fc1404bb0666d40b29321638ed51e39d_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:2d7b68b4f23d75da7621764374c940758ef3253e205b3d5fc3a9361b029bb61c_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:4325fa7ade6d29381fe159923e76ada1dfbae2c71703df682ac6d31fc42b030d_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:6045be8b03aa8332480ea5e7baf2fcd029ebd046ef65648896818d7ae94136df_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:96aecd8114566e8fdb22343a30aa99405e7dc1a0e02e815568f4839f6fa0283c_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:c1a875501d371fb59d118070349ad7a0e16f76e494655177a6280ace62d7d60e_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:faa90a7bb2075bb2c2d1aea55484e52a9a20aea160feb930a139e280ee8e4157_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:3e2869f3751c6cb609fc921c599e56e3f856ebc2daea7dedc708d26d75ac53f3_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:6c344e3872b3ff0ce1c3f3de6d198ce14413b3be5838d052aeb6fbd74ffa3506_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:9bda785e719920015c8729caa816cb6467ef17d752d94569e4783bbb45b1325a_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:1b1092a472117e13c3513fbc66b8d54e6734dbb6b118704a836a41500c29a179_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:8c072572ce4c3ca11061195e81f8803dea4671f37f8e1536667bbd95e9071804_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:fc8741169eba272de1ca4726d1052e7e885363c6eb7a9e099a636f6d15cf56c8_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:4269ae0bfc9001d41fbdda42536d85b24cd2033603448853226017f8e4373e78_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:4c552e89ed9ff3e295c8a47f8b4c21506448034929f2bf3a5ebf67266f658d8a_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:616bbe0f4ef3b0b04beb0ee03f5d6f4b03020eaed10208f2c94af1f3c22ff83b_s390x as a component of Red Hat Container Native Virtualization 4.20

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)