RHSA-2026:83663HighCVSS 7.5

Red Hat Security Advisory: MTV RHEL9 Images

Published
October 15, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (4)

CVE-2026-50162 →CVE-2026-56852 →CVE-2026-59887 →CVE-2026-84445 →

📋 Description

CVE-2026-50162 — oras-go: oras-go: File store write outside working directory via symlink traversal CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-59887 — linkify-it: linkify-it: Denial of Service via crafted mailto: links CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products15

  • Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:a971c06918017c4b36f6f1f3dbff8a61d336b68b9dac22a124a757ae45f809fc_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-cli-download-rhel9@sha256:2ec931bab5cce67a24f7f55536b090e91ce8f13bda3fe7324b133cc35f682fa9_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:a8cea4674182c181ac918ebb74ada1a3029c8c75d844e1a022ca583ca5ca9e44_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:87fb394733eabb821d8be779316e5225d45cf9ce4f09225a7c203f2a14d6385c_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel9@sha256:057bf56acae27a2a7c4fbb9ebd2857b932d9324b2002cab41f21f2931431a098_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:37fe0eff444c0b4ef70c9aefb836d9d412b68aecc3050574768b2f376c971be8_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:3f7320158484a43b3576a675be4decb5d16e2a43287fa97bcf4717cedc32d2ed_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:a5fabf9832c0dda8be34e43f49284f5b6c1c7bbb5ad75d89b7331c3a8d598a95_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-ova-proxy-rhel9@sha256:057f4104612a3923c224c14e0b4d4a65130d71098fdfcb1f0144ccb9670f75c5_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:77c123b144057c5a08d4d11eda84478706bd11ef4a8a1115e7d617a14827be67_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:df61f9084cb325db0dc5b38628fa0f06a958d4951714775e2cecfa041d1bb225_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:3535fe7d87872ca3ec41a0eccb05f66b84f05e33044ab182398997465e95007b_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:e3d35ef0434fa976a2f6a8c910391d669fa145ad67e2ca36d281497d088a8d8f_amd64 as a component of Migration Toolkit for Virtualization 2.10
  • registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:292fc6d7fbb4d2d77dac30784303a4d2f782795416b68259cfd772d9e3d518f6_amd64 as a component of Migration Toolkit for Virtualization 2.10

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (8)