RHSA-2026:59109HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

Published
August 24, 2026
Last Modified
September 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products22

  • Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:005bc530d7a9d6eca19305c16c2348923b3df159979d982cf52b9005de9e5612_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:a54d063411650a1342801e14910b13439b20583f79364d6fc190235979693947_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:fe7da88523d4731e9eddabb9c8446a35066d14e5bb9b3097bf08715d3d949b80_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:0b12e0088cc376423c44e60bb9137b431734bb5a35fd5c8ba7bf70d944bc3283_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:67b1627c5b3df1f7414aef113ae99afaafc5b4b557028855747416bbca44aa11_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:f5e44f26a53a97e1ecb1a4a58846cd85118456dec9ccf50f2f1eb3156acc9855_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:34c6397760646b3cdcc5772d18d38fab6da5aad6110bc7fd980c75401eeda8a9_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:3515f791c7ec45aa203c2d1f7fc84081ea818c3a03c3dc06296fccb0d0332695_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:4e370261b7553189216233d57c6fe03b2fe7d8dd427ae44c4b90671f29e5b966_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:721a9cf861e335bee499460835858a636d0c120858b4ef99f4a4fc6c96f7955d_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:819ebeeb3f069c714538cc8b8c597389a7dbe5a0d166eb9bbd08642ff27d1052_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:e1673280768a92f5a9b7ac6e9576a3095e06ebe43e45374625b1252ed2f236b6_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:08226a343c7b6cff75522701b3b579f97ab66fd6d687756030708a878ace94ca_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:39e15a6648fa551da9c8779d9067e68746de0e1ec39fb0f5cea7d0670d9c57f6_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:4ba97ce15b28e248b5bbe655c7a69245797da4cbc0b5a03359b2fd6c97485f7f_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:05b64e83c24f284099cab26c833787bcf285b6f602effad67d3f7d2330ade855_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:8840c8447cc1789d0461f86e9147f0359217a18c297362f05c9166a8904661a0_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:f90d0f1e2ef5cd252ceaee8d97be3c92f43391f82c50f190e763ec585da6ed6f_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:61ac0e3ade40a224879cb358c1121e57d093b37784b6522eabc73cc66b3cd9a9_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:a46584fa4a7b986aa986f7070a5ce5b275a6dc4f36672075da6f3f35b53636eb_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:ee027a811905e245c274499fc434c9553b115d084d30adf02ff30de560c0c6d1_s390x as a component of Red Hat Container Native Virtualization 4.19

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)