RHSA-2026:27914HighCVSS 7.7

Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

Published
June 22, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (2)

CVE-2026-9804 →CVE-2026-35469 →

📋 Description

CVE-2026-9804 — kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products40

  • Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:021c391d7fc4f67c7bd9ecc7684ea23a6a4902170b2b4e666c42fc38bd781d56_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:51a8ce81353343cd564499cd4915dcfa7e3d31de7291eaf9b0edadc7fdccec74_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:d9e72d04c02f84437ac33304da4931789ca6958b16a321447e4b8e417ccdf910_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:002d380514273420bc180a6de174e1b90a288ecfc703bfd6b94f424c607560c1_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:713c559648c386010bcc2cf6c70111e9d8752677a313383f9c422a0106addfe4_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:d4f980f0f156f859b61656bc1d2911e67df0cdca109d7479fba4d127bb4f8e85_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:38cfb8307cf26f315b47f5e247a7983be6c8a5ffd01ff0b1d72cc3761cc07e39_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:a515f295610f4a956fa852963afb3e4093a1e3854510c0087ba80fe5ec96ce48_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:ec968849bb7710250806999a1b9abe56d0a6ba3ff2e6726647c3f9f770320488_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:14cf5e379dc448f8824bce13aa0b4d4558e02db52e73f12d44d19414591bd3c3_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:17e15d4256ef0fb8a9fb5bd283900b184589ddf74b68cbcd6207564fc31dedf1_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:52bb98437d9d09d818c1c3c48e2e56277d7caf06dae3b946cf00731ced8de1b2_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:542c0d7c1fb9f2d5b0c3d0acc71b7179bfd1dd4ace358597ef411e9c6ca9b502_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:70c6e9c00d975145511f6fba4a0ba5d64044ed90cca93227a0867b442695128a_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a792b3e1810a13ad751cb476d7015faf8f74bb3f643b690bd057776d1d033ee0_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:337b9f9d61f626ec4787d8e29263b7c7659f9be4e726683642605396ef4f2323_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:c9c4c460c0f3f777ddb6e5a96bc713e1e93b65ae15bf0824b6546b562714c345_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:d9ac41bd11bc3949eaaa91fb428e1d7b5072ed5146598804e0b8050ed713b9f3_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:a27a91a06b040869dc9ba2d41ad5997509adfedf8b685e88f472da45ac5231b3_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:a82ae31f8417b2894e13012cac87aaf48aba39a0b1d1702186ad38f2ef658755_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:afadbc3feffba0042274f1836f1a6ed4e77c931e83c59f26ce694d539433fffd_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:3123a7926db27ffb17d9e0b88937a5110f4fe3c3b0648dcfa8ba6dafce376da4_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:44ed2f3b997158dd821397f3f9615d4767ebcdeea81d4286696a012e35cc8535_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:8f182013008e115fb412a63a80b58119b8cfa899a3b7b816396af422119fe1c1_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:1233b7b0684b5ba7eb4b413a17cd70c659ad230c70495b5277cd3139ceb40a9d_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:393d78fb4afa333018f14dc0a6595f612c6f2fd1370b26e7a0d21cb52eccd1f4_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:a9a820af65a6c5da1d7f708f24d226ef2daff9d886305e88a632b32dc0d62227_amd64 as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:0721f8a624942860779f18691b6d0fbb028460c6fbff113d28e59f6d31b2270a_s390x as a component of Red Hat Container Native Virtualization 4.19
  • registry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:38749d57d482311927812de109b1dffde2cccac836fb783e15a8899ec589a94d_arm64 as a component of Red Hat Container Native Virtualization 4.19
  • +10 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)