RHSA-2026:27903HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (2)

CVE-2026-9804 →CVE-2026-35469 →

📋 Description

CVE-2026-9804 — kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products43

  • Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:3e35796163cf12c144f6e68c2cdc08aad7a0a9787d86c21ae896f975272e4910_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:407b24fd81006c833156c175b5b3282b5c983c613e49aa65824151b36f5124b3_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:8d921ac8b01fe1ef96f1df1f4bd75fb5208076288d2918d6cfdc52f1ac6fa254_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:1255de6db0f09582eaf121164e90dbe18366940b2558b9840f4a5d5bba3bf2c0_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:a8c558546e6e89318ff9efccfb94d011789dafff5d9059df967763fa9662827e_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:addb0f1697459cd354ca7d08592d5802aa53f3d34f1cd71ad567b7a659f144b3_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:690de966852395d00796a187820dc91f86a2eb56bbb34883bb29e42d37a09d89_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:a62b253cdabe5010eec54807cf805c962199bf678c17a1dd4d2df2184516781b_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:b4e3a2a5bb02e8bbba21cba4a34d398e2a29ad325c407a049e526efd698f4896_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:27faa21761a881c01425b1b1879d6172af4a950832588c5fc275756d796de2b0_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:723d98645257ab1cd6755a6be2e1a8ffc52b12efdf3de5a702799d092d876f0c_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:ff8e6efbcdfef2016c2f3aa449fa9c92b2584e46f107ac0291adc56b046ed1ad_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:7ee6a99028626343830aa42b6a8006d2bf03d585dbd9dbece6a8c5288ecd0bd6_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:9240b0e68700385fd5ff0bc054a28319538be8bf1c0c5071077ab3b584e200fa_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a8eb7efe7cd0ed4cef9fc201c1fed994ce30c969a2b9dd9b2bb201e6d194227d_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:329d14f15c8938592a3f387e18c6a91984c14b7c308e5a768ab0d0f2a5e860af_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:7ce5f79a57ff794cad03f005eba0892a97f0f36d2efa44c31954cb6b26f7297e_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:aeda5ca46f89b1aa9fa114f806f91629104557234c4ef802bdb871141a505cc1_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:1273d55c55de823a7bb516d7a5bd7b6fd5ff105d90752276a0f3de77b1db2294_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:864ab0bc96a281ddf316126491d6eef1847674570d8fd4a0a003ad0773d89956_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:8fd471cf2efa55303bd36c4284d36310cc9330aecbf9b6fec05124d2b3a5b800_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:42dad76adff74b85c3ef653c4de263e8a06252213f91aecf331fc71c15ec416d_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:58cfd9970c11781e012fd1a29441d9f34c0c7fa00674e2e6069b0846804b68e2_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:afdc0ee42b523e43280022c1059d21af0ef26e6a7e8f963dbcca3d0d4aead460_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:8858d630ac7da25066e8e0c9092a364346952afc543f8db6c2da88c3303e5626_amd64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:bc9f2d6eae6598384d64e94c7719ca6278b3479b5822d6caaee9706bbaf49d62_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:c923b03ca0af96c491cb6eead4bd95072deaf25521f4790a9715b63f90e7b8d2_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:0f139421f6a28079640ec2166e9f47bc8e800d5ed0a4f74733ee92910d41cde2_s390x as a component of Red Hat Container Native Virtualization 4.21
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:42c795be0f550e3e558aedbeb48587db9dc2d703704b26f1f640affad1ded53e_arm64 as a component of Red Hat Container Native Virtualization 4.21
  • +13 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)