Red Hat Security Advisory: OpenShift Virtualization v4.17 Images
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
🎯 Affected products3
- Red Hat Container Native Virtualization 4.17
- registry.redhat.io/container-native-virtualization/kubevirt-template-validator-rhel9@sha256:77798d82393fc190ff6e7951e77add2664c025aec3904a0b3cfd52dd6e8ca1e4_arm64 as a component of Red Hat Container Native Virtualization 4.17
- registry.redhat.io/container-native-virtualization/kubevirt-template-validator-rhel9@sha256:f8d1a9b5fac7356778b2c394443693662f4381a380342f51210989d0841432f8_amd64 as a component of Red Hat Container Native Virtualization 4.17
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.