RHSA-2026:62599HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.14 Images

Published
September 2, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-17527 →

📋 Description

CVE-2026-17527 — virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

🎯 Affected products15

  • Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:2968b9e4d839086e41b7b2d6ef4c039c358b381447fa79cb3fe91b5c6496d84b_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-apiserver-rhel9@sha256:b16b2d00b9fc7b2901bfde882bad862c54abf5c6378fcd796b174befc55fd9f3_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:66e10af48bbf67b1ce6235f54b98be6c8075d6ddbe3e5406f9e85593425c3b5e_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-cloner-rhel9@sha256:ec3cebfa97b2a10d40de73a6fe3f837804624fa716708130ca48144303a2ecd7_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:3dac58e5ed40d2673c9d95a004079421de421700f50a894e8a443cfbc4d3ffe2_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-controller-rhel9@sha256:924409b442d576ab4e732d662050fbdfea6d207ed998ef38ccf85c4d415ab2cf_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:762dbf0626bd3b7ed4dee62ef3eb92a48158d2d150d1caafc768719702cebb44_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-importer-rhel9@sha256:990d7c53d3a3adc68d1a2299a1db03380ee1d34701c6e634c00b600a934466ed_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:20fc64246579e137d8c8eaba0e675e2169362354153db5a23fbcf5bb35515824_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9@sha256:2ecf82a61d32a64573573f483dd275392d41bc95a615c5290a36330465ddb075_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:8d27e2931cc339544b0b2a27f99eeed49e4346e3ff2828d610e1c0c101c1f880_amd64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadproxy-rhel9@sha256:b97c2608e974cb7195ad9706ba414b498b12b48758b032a76633c2364ed8d34c_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:2865a80fedf2e6d0546c85fb28f13b3564e96343f03d7db92e7cab178cdc9e16_arm64 as a component of Red Hat Container Native Virtualization 4.14
  • registry.redhat.io/container-native-virtualization/virt-cdi-uploadserver-rhel9@sha256:f9f2fadd505b3adafc4c1a0e8a7744f00fc89f9c72bc2925eef5657f10fc3b5f_amd64 as a component of Red Hat Container Native Virtualization 4.14

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Until a fix is available, cluster administrators should avoid granting cdi.kubevirt.io:view (or the built-in Kubernetes view role, which aggregates it) via cluster-wide ClusterRoleBinding. Prefer namespace-scoped RoleBindings, and audit which namespaces grant both view-equivalent access and separate edit/admin access to the same identities, since that combination is what enables cross-namespace data exfiltration.

🔗 References (4)