RHSA-2026:83662HighCVSS 8.1

Red Hat Security Advisory: MTV RHEL9 Images

Published
October 15, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (5)

CVE-2026-50162 →CVE-2026-56852 →CVE-2026-59887 →CVE-2026-84445 →CVE-2026-88031 →

📋 Description

CVE-2026-50162 — oras-go: oras-go: File store write outside working directory via symlink traversal CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-59887 — linkify-it: linkify-it: Denial of Service via crafted mailto: links CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs

🎯 Affected products15

  • Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:1a64d633b57fe3f287f850a32b8944acebeb53b9f2635360c1828f052fe14dfe_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:ebd66ac890df1a38947838966310f23d4abf4ec1769c3c207d1c31fd949b1e93_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:9627d5a496737716241bdbdb0312fca9370f2673b0ae22bdbdd455767a3afe45_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:acbadc3f7ef0699e858d497acf7c8ae6d9073906f222d793a2907011066c7a16_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:f6a243876322be64af0ebe46c15e9954b38e1197e185a3a75844cfb4d84bd582_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:d4990c1d9ef8253ba76f9160f4e9d1a5b505b94fbe9bbb7ac2827c2b93937c39_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:e63d82f2af0a9211b6a7bf6ec08940557dd3091ad4c9a4f7e663c25660821900_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:06f651c0182b497208c809cf6f1279171e3aca0aadd62075a0aa71ad76badaae_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:25b3df137db02c1a5962d4b4facda8047d172fae24e21dc3ef970a8dfb152605_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:1dd8b8ea9dde297dbf9dea4ffb6e630cf8547b34c4de565d1fb657ad344db33d_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:4f062b8d9c4151cd772b33761f351886115198ae16d06a1be18e8aa99dff9b84_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:be057c014f23d0ebaa3d21c3d99e1558cdd6efccb9063f6c7c4dd98897fcac81_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:688d769214d9de0458152de609d1d57e89eedb1c56d75bbc8c02b1652e04767a_amd64 as a component of Migration Toolkit for Virtualization 2.11
  • registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:8c33e0b35bfae6892f89a9195481cb1b2d926b9120cf9a2147e232b30dad8bd1_amd64 as a component of Migration Toolkit for Virtualization 2.11

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.11/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).

🔗 References (9)