RHSA-2026:60301HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

Published
August 26, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products22

  • Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:73a3c12dda8511f89799ac08686eb60bc8ffbad2f291c42462d3d9a127a8c0c6_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:b0dc3fdba9ee95797952b5d1c1c0db0f28481d0b518a82f865ccc491ab2a6acb_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:f49f5b9a38ad7aaafc1f0e740c5328692c806f4092348c42a1188cb0ea0a9512_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:231d14bba986c7ef1cb9f6574a7dd6cc02ae76d5e0f1fb944dc954d54fc31fda_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:ce146dd2e2bbe1f4b96ac3ec80b4e3f18d4f5b073169f7f89f68d1b5a2ad9433_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:fb585281433c574ec413928bcee22bd202b7334305527384f6d64e6e4b2618cf_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:2d51e259b4a24207c12d96b9765997da1043555428cf72d92834f735d2267f30_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:6d9cee6ae0dcab4fd67ca9640f78c841a53caf0b50e3711d722ac67569c783fb_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:adea94b6161b47cf2b6ec2fd64130231db381444e9474fc811b9d877f90174e9_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:6f0f287d911595911f5c76e644764ba41712cfe2a84e356a1ac1c35857ba333e_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:ad24e3330b09baf95a8f363dcbc7e6888ae2231585efe6e185d2851cc97a458a_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:bd3145558df2d7ec518a209a89be8eb1d7c6084f02c202c29d9f2bc6818b0630_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:3bbd2114fd3b1cd8e1f5e5d41ca3b2c2d487975afb134c5993f70793b602b53a_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:7b0a2c7861756deda65c017058fe10cf9951523610a31086ae405aad5090df5c_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:900820de93ea673512c9eb5d5a9c1a714d85d957d03716240785344f6ff4a747_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:4aac1bff6943245bd09e59d92b7d6f0f155454bdfcc6d468996ee4bfa910f40f_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:59f7fafab699fb21827df749f61779bf68175892cf51fb2a107289829849f10f_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:7f3b2902ec32acc3f38a2b3bac3a19895e9b2f4db4f4c3cf4238a02af35b265a_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:44ef2ff13d5e1230e0d5072f88a0d40a419c7300f5b7a51ece74cd991bcc0f00_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:4b155f0a2f06b248741f8cbdbcd38b5591dbbdbc7ab852998c671197a4daa23e_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:7d84c72302d13da6ccd313cc3b3fdca82756171b15423741ed368aa5f774306d_arm64 as a component of Red Hat Container Native Virtualization 4.18

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)