RHSA-2026:20782HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products43

  • Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:99b62e9cb322bced2f17418bac34a43519cf541f7aa641cb22b308a9b1ac2895_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:c6102017455ff36eb776906dfa36d33b27f1f36d5f0f218b09bc4604be666211_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:dd8e698ac6ca800d9bf176c8aa7b6f228900722210d7b7312bdc40b7a3e7194e_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:0871b5cb18f79085b26491c53ed6de28e0cdbd672e8c334f650f30f12f2dceb4_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:dd3fe0e66d563b9441c145c34f4f1eb8a011f6f8aded817f29a8a71918a0362b_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:f6ea9774ebf21be785c7cc25ee2d635dcd22198b259b1661f2b4be5cdf20b664_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:1ed30031c767fa9dfc28d409a64a1ed98f01f07144acacbe69ce5548a3c0ef8b_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:37fff456d17562d1723982b167569ad840b9da87daff6b0c92ff2b46378f5859_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:c8ff3743509d0d7de34659c7f2a820ebe820ab09bd0e5a59ead980ef53748b4d_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:5475e20af88fe559d0edf987752d8f02b31016169e0fd54025a4ebfcd3612c7b_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:92d06a54a1d57b5a0773379f0592612ea0dc197e6febe6b7cda2313a2048f9c3_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:f6d18067061a59f92f1baaf319968aba016c3b075c474368eab2fea431e20d85_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:39df25d39cfc9561976d4becdc511b7d8130b107350dc66df0790d7fe0e11868_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:439967672ae7d47f2ea90153992ba840582f0a808411ef593672d79bd6496d58_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:8d3b27108d62d0e8f8ef9b86d4bb20199f47fa19fb5e987e4ddb9e3d38c19ca5_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:af3bdbe03e4bc55cd9e4ebe99af44c1be2cc0c09d0a6b830d43fe4b17f8e2d82_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:b80b5aadce79be11087768136394617c8a96dcd163ab630722cc430ba1f09fa6_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:d83885be9825624606b938d7dd24a68fa018f847c4ecf21f5a96396871db4c69_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:69427e4bb29a090020c956debe29a86fb93cec0b201f36d60d1d2dd39cf5274c_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:6ce4c0f1901419402fcea9c082dddc8d95535dea7adbe9cfcc67580c3b05a918_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:7ad0ca3d4b37da3346f4e31f0ffe18b93fe9eff5c66d46bef3cb50ae5e087dbc_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:3d76053d38f42c4445c9211f2e06c9c8c082d3ff35e2ff00f858e2be01c2d824_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:b0643f86fd762799bf0b97590d19a30b5be20a963b2fa2e7eb8628d436053dc2_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:f0b9f46f720219de757d14a19aa58d0216a531a715440d9284f492075c3fe7a8_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:51976987b2f9d0ce628c478416fbdafc0164411546f67fc651c53b417d8da3e1_s390x as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:998fdf82a5998372cb481477409787275a23528decb1a329958d3edbd42fa7f6_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:f16c0e43c4e7f565103d53097f782334a30493fdac7d17ed70f4114b3f06a36e_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:46ade98515cb573186acb33ea6cea7dbee1c03fe8ab8c59e99d3a18add07577d_amd64 as a component of Red Hat Container Native Virtualization 4.20
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b5bd92a0cf33ed6c507da9906c639abd9d6d19ef51787ec8f3e4ad361fee8ae5_arm64 as a component of Red Hat Container Native Virtualization 4.20
  • +13 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)