RHSA-2026:61666HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

Published
August 31, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products15

  • Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:10525cf5803896e39f6bbb28081b357527ba7c28ba787e08a39d223faf01bf02_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:9bc5fb245f8f667e4ce17cd90fcf2c9134dc571b4e2e54e9bb4bba824348e727_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:04359ff43034dd4536eb4e6345dcd903c496e5ac460cfacbef63f3c29af35bbd_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:d9f0a3ac34543fc42e9a5985b9c64eaa0dffb08f062e5853dd7c193e88a2702b_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:9b2e73f1ea341f51af92b1a868aaed62dadf227a12110127f2b582e219516427_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:c88134a6b35747f57667ef8c7baf5c6d49bdfc8786ebbbe26ce4d41cc4682f74_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:9b17ee2dafa64cdd90ab73cda720b5f279641815056d99c28028360cac07b603_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:dab38b6ae0658c23f0188d1d7e6298b46adef642449dbdcac8c91c6d63161c99_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:acb478640fef4c15d638ac4452124e96d74ad5d6ceb73ec7d974e4aef3d433f3_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:f9269f0b0bc9a79e239c48285c88138f33a651ba911e9f766a96de78e06d8756_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:0e9d7a95c72da71d83568d5ed184003303c155b1a66cc1b7788c5bc9f5ec9e56_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:e1184cb6d524a0e1ffc9929b442f8d345709ffa976acbb9bb6c9d2217f9ab1ea_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:7c894771f97f93beae8fb714db6a9618586be9ca9ac2bb09dc7ce3b181e97e09_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:f947c75bc27d923ac20e337e80cd7a6da4cb0d23dc6ad80602848b4195a8e172_arm64 as a component of Red Hat Container Native Virtualization 4.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)