RHSA-2026:20975HighCVSS 9.9

Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

Published
May 26, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-7374 →

📋 Description

CVE-2026-7374 — kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability

🎯 Affected products27

  • Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:01d8b8805fd275229eed0d6dbc477f779fcb9302409538948fd6856701d16b90_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:23b0fe8fd19443d08469b8fe93a471f79039c87ca94408f6dd675407048a70ec_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:97493024b6620540c053d89c6a3b02e8ae8008a2342d95bb8f5dc1ca4abf9a5e_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:bad30ab59a88284693f07d1129e47d7a9251325d6f120a644808049c63858b26_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:ac61513d0d8d184be43cd58f3c700226b2090384b3ee1ac5b891b03dfe91aed7_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:e15f0631d5a8883221df836f3dffece8ceddd797d1f3156a5ff3d7f822040fda_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:81a4fa07ba02640943a15612736d32c164b10c208c107ff261ed9399cb0c32fc_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:bda0942d9948e2576cd941c73b1c90197c26842c78b1dd0f9930cce10601f889_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:bf3c69bb43e28fc348101888da5cd3103468a9b5194c80263a4c3c2f590d5017_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:f6a80e08fba710719264d4c1faafe36e5c4155cbfdd51a79de1e55e9997b46a0_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:717f3d3fc2d767f4c25b4e9f410eb2da697cd2672b830ec3e8c9a9ff76c79dfe_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:74c1d0bdb69e09e17359e1f7ded96fe59c89adc8563aefb18702bd14eac5bf1a_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:48d09ebba3d0c513a9ccf1bd0eab5e7bce4aa42a23d8cb620ce6dd8d95e65c05_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:f3141446e09b1f9660d7eb57728a5a7c255df9292ad7a6879b7d44fd9e14c982_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:3f69586b231ff1b95ed8805f734465ebb2cb1b2a50132836d8d2bd2e253b2407_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:b19b005a015d85dcf3da7dd54a07b1e6f9e4eee84db1cba9e44808611dc496e5_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:0d13f9c5f619ff3d58d363214fc45625ce64833bc62d66c33efb2ef191090316_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:6eadcf10463c5789188d3638e30a809ac2a4cdc9014c6f6e82b4d8f4bea967a7_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:833e84f48ae091129fd3967488cb59e1dcef6ad240e4fe1580af4f640c524a1c_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:9ce927232dbc0fd2427ca5990801013c1ba92b2af466eabafb99b0eaa405c900_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:3f39822dbf9a5ad965f4e09b66ad4319c95e38492095e1a5265033d3d245c060_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:6b730620ed5a6f37170c7ef44a5883e6d8787e30862525fc8ff605ec5e612235_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:8bd7de7b45ae11dd92debd4cb98ef01082bfc46e79ded2ac0529bd8f8f08dd59_amd64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:c847a1c36e65c2096e964ab53e47f4bb6490cba74073ab25665c7d6250f78503_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:96bbb1af0c87e73b6d5fad7803e1625be6dcaef1021e8e7e53305a37fa0ab8ea_arm64 as a component of Red Hat Container Native Virtualization 4.16
  • registry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:c431ca45ea5e2185c00cfb051d6ddbac9dd14dc2e3bf064354f71af61709331c_amd64 as a component of Red Hat Container Native Virtualization 4.16

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update cluster RBAC to not allow exec into virt-launcher pods.

🔗 References (4)