RHSA-2026:20825HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products10

  • Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64 as a component of Red Hat Container Native Virtualization 4.12

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)