RHSA-2026:60117HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

Published
August 26, 2026
Last Modified
September 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products22

  • Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:20483571ae53e8ef6d523e93a2683e49bba0eaca38d1a9c59e0e8df091230efa_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:21aaf69e4aa1dc8148e4030b7aa80a435786e9002cf1d65d6c9dc9c7f78d41ff_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:dfd54a80699f437d36d4dc9f676798538dfac3668c24e6a2defebe052897726f_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:25d54465d63cd85a1b7f55fef8e510c07ff35a67e868c2018fdd2abe93db0bac_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:e236874e3d7628c8beb47e97b61fe197839a63a94a28a3da7281ae84878876d2_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:f49b85fe40c6db83a315e65cffe4d11a19f63d096a13a04815c7a93764b93c97_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:120970ebf46572da52828e236bc0e403f1b5323f392d38cdf16074f093164b4f_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:da9f5b8209e133d4e440e2cbb149edf91d71bc321f10ffbd059f3fff5bd18d16_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:fe248f5429530f0e13d3d623c7476a56efce90ab318401d0bf91cb924025066e_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:834b9d6a23e0d7e0405624d4ddc4a56eabd77d43159c04cfe1351cd0cefe5c3c_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:e4d873036d1c11ab9e147677c6abe71efecc4381364279775c61f740c557fd15_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:fb1a3243f298254f1978d61794990e35ccfcd4ac3279b6eb0115ffd0f30d74d1_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:38f3969849da1086235956bba1b1e6a39ceb31e85a0dc02d12f42f5c741f05c3_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:6bc744716583703b7a473c04cbd39a8c12edc69a503c013b87414eab785be413_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:7db0a9d913b854007aa80a2905646f05cb3cbe8194af04057ef83de3e275a249_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:475713168a18cdaf598ac889874a1711c5a12b0ca8dec75373947579e75beea0_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:9cc5786db64860e801fbde9e04552a0dd4443756c9530c8c4672a9148c805989_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:a53c9bcccbc2c5b814deaad24d1d829d4781ee69d4a4ae969f6ee6dbf7784f3f_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:a38b2a92fdd93375b17063345f60c5d2065f36d8e5334f73aee0bbfe4ee98560_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:b9fe7c8d6847e59568ab40dcf9f1fafe69f3a39dc5c76363d9dc8a4fc66a0391_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:dfe1fcda28a61b1341c80cbb7e84fe8846df9cf18072c84b474de623c8106c65_s390x as a component of Red Hat Container Native Virtualization 4.22

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)