RHSA-2026:93960HighCVSS 9.1

Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Published
November 2, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:5da996ff2cb173174db3030687af9f99aaf2b772dccc1b392716861b67dbd4f2_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:8e85bc50d27748ed5cc9ecbc8f4ed9e340432b1e4dccb374026196cb2afb93fb_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:0181aeeb18295aac490abac1b07b390255d600b7bf2d5822bf6257bd3beab45f_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:09d7e3127c801c1fec509d93f3ab4fc16cd60168a90fc9982360d5612b4b93cc_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:1b2499e85d4dd97357cb9f26f62546f76eeb71ebffecb034958b9a2c0776655d_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:5a14c4288ae2b57278853b611e881941654eb83d7d6fa8951b1e74cd79e931a6_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:d2168d287ccf88569be63354f7f292dc0ab8064ad145cf6b90f553dc616fe279_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:f26f9a9bd6438e355291adeb9b3067520b2abe33f2b4c23a5e7991585c187588_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:373e414d21b358d195f9ededfb20261cf793bf1575130ae23a2a0341eadd76aa_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:65e571251753a9f639c0fd17486a6b2a9b8af644e66d2906fcace8b8c01642c0_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:1f4b29e6d310907ad0dd0708d1754197a16de08d5744b3a0c6313fc731b48c39_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:e0a2effa318cb31d37b73f2d602bf15bd1800c49cc6dabb3b333b7f52d0eb5f9_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:1a538194bfaeb30550351d445e205795c2f39eb87280e31c8da4982a7707aac4_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:ffd9c62c60c7853db053cb1fbe43b1172b17d913e402035c7d6beff6cb161df3_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:3725fd07d72614226b5affb77333d1342b866daebc198aff6dc9848fd69f825e_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:79ac2cdb927095f729648e818d8bc6fdbc2c31e6f477a384d02edb4e038e7438_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:c714eef90a588ee073e8a02eada99c82bc4bf1fc369f4231f3da62433a835ca6_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:e9e2176d294ddb3dfd7a1a8d65c93bd31f80c74a140af13ca55f4e830a310e84_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:458785496cf64fdaf4c2b54ba3c3c80d6eba16ea3f284e2c2c6bdd42f52bc34b_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:87a74661ba95506a6abdb321c88b375480b6cffdf15de0d4e93f41b021760610_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:10c6bf2932a5a0355516a0acc9038e14a9610e487b05dd2931f599a25f70ba5a_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:2481d71daea49ffdf8e67a7d6c3bc2abc9e5205c7c54acb8273c1add648fb283_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:9331dd042e0b0a067d407fee2b4269383d44d2d42c561ff800e86b376e4289e6_arm64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:d24dce9d2918cf06db72033dc465747d4d6f3fe2a2101a415889405a6bc1ae4d_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:3bf044ceb292edcde082282672c08f6d39ee31ff364b22b8d48f23be54dbddb4_amd64 as a component of Red Hat Container Native Virtualization 4.17
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:4c1fc79777a35944d070be0f0d723e21ce33b74b778e33f4f0c0610eb6cbb88c_arm64 as a component of Red Hat Container Native Virtualization 4.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)