RHSA-2026:27913HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.18 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-9804 →

📋 Description

CVE-2026-9804 — kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read

🎯 Affected products40

  • Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:bb4c302e82522be793b89b5bd50f0c9f3ca3824a348add7c9b35e425a7f5c2a0_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:be8006d401d2af27a90f921e01ff5ef2c53782c17e94f62f56e8e7549db81e59_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:e142dbd3d65b7491580198d69bd20d8f255960eea4c90ed38c31665003fcc532_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:560e68af97592a72d315ef394ba655c8e124bc91d8e8ca23c57f206229bdb447_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:6fae6f777870ea97eeba8f7855a92e5bad0d9253bf243fc74cbe1f9429e01ea9_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:88efe46ab8be123d531c25a6157dbf3b4bb9d14d6030ddaf0552b7ac27d4d70c_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:411ea9cd9a125fa1a83cc1320ea30a55f12186a23d5b7163db7ed8ac24bf2b81_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:4808d25446943381560d465e84d4c90f6385989f007c431b966c2ef23c3a1387_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:a37cbefc2b0072a6e02db7e0407c831e2d81da4bdfef1f6e2c821545deb4300b_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:4bfa7b7aacce5bd4472121fcd0c2e99aec4749352899e9dd81c30d43e6d7ca81_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:86bb6e835418fee7e984d2744103423ed018fa5a5b80ef28ed234adea1cfeb87_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:c5ae444aa3c8754b3eada073f93307e454a8a78e3b853cc944abd48db861af39_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:d9a22115b64b8fd74c946ce96148200adbc20e7fb1cff26f327cbe6a8492fa98_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:f40dff5347a8e01617584c48e20104b68dfabdd84cd37b8ea30da63916971279_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:fd6ed638539dbb0a03270ced6b96e688512109180d2f3d50fa2d16aff3bfe30b_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:7706f912ff3be294deee67428ef619fab298b36df0c3d1e7881aa2394b5ada36_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:b85df4ded3e175e05cb3dcd69465f617715fa9cd5d1d524b99f724e4be0b557f_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:ba20747a1421da5429ce9f57b5a8adb8a2f1ecc624dae2eeebbfc1c35a8f3670_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:943d33a30341937ff8835caf2a201e105ed5b344fe4ac112933ff0338c57105b_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:9d5ecf2c252cabebecf1e931c77ea0ae42d90b74e5f985e2dd3035008665b894_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:bcda1ee3c5435aa22820e774d67dd86232ff4b465325aa2c769881c638d9cceb_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:36a81a7c0daf61504b2b59d9e8cb3605e34af300194cbf3444fe423f69383115_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:3b41bd9a78f21b43a2b0fb4f51099fcd7669baa4c5fb95de0b0b98cb4fd2fabf_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:869530d2a3ee32bd243936622d89fa28b47e80a9fabe49a56c03898b87c70d67_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:160bf5ad7232dae53f56f619b95ef47052e617268ae05cc256e97f6082bf3e6b_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:28a603bccc7d8da9371f83cee7ca62165192f4998a6a4fdf33914e50e9f09b7b_s390x as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:5a4e16821b9f628029b38918a9bf41063f14014fe6003e5e7866ffeba61e579f_amd64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:56b278ab96c4ab767ef06d29e0bf3e8906d6b189da41310c84e95fbea25d2691_arm64 as a component of Red Hat Container Native Virtualization 4.18
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:a4f34fded28353093eabc80eae9ef84b031c66c2b1dd6fad9470e501c456c63c_s390x as a component of Red Hat Container Native Virtualization 4.18
  • +10 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

🔗 References (4)