RHSA-2026:60146HighCVSS 9.1

Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

Published
August 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products50

  • Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:20eab881ecf8ce169e3bccc59da3b25f2103396c97ea4b1e98313dd7f22751bd_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:91bf2725e61d26fc00a98b9c9cf2340a34f81b4de67025be78ed3c98922470c5_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:f042ba19fece1d246d0f73b46f7b434cd494c22a28fd280570fb28c630c24176_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:1664c8f5b2080c0557007aa3b7174a3bceb27bf186817fd012e933eb658fcfd3_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:1dabd5163ce75e8200ac8d015bce1f90882b6f9b2f77c686a5ac79767d381913_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:9c76eeea53f1934a1706a280a92526863aef30bed8475766035ab633ab2f1bab_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:08a7004f1b560764f8182d665d1562f6a8ef43a5372795cf2b997b38393e573c_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:3b1b85f717385eef4dff150816c963ca2efe0a3bdf60e5ed49395da775184f4e_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:d28257de59363f61e3b5384a2670431e5995eecc43e8f3bb10aa150ea6b7ef7f_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:4832fe439ca47545e884dc55fb9c54facef6e571bd9b42adc7fa2a15170b30fc_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:69bd1352fb594f1ffc47ee6b8d805a52fc6dbae8fc9b02fd84698e7bf715f84d_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:a98165e4a4aa54c08c96aab5507db142b637d033e7d933f2e864007255e73780_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:af53d9b8d7ff22b02542ece0287b74454c682ffb91457a26afbaf09136984942_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:dcc685a67056c08568364d6d82e79099b3397f7f7bed16266d32c321bb1e59d9_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:ffb03504f17cce891f509479e8269ab5ef8ca83f91c06c3f9e8c5cb07bd2a82b_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:52916f7c61840af209599959fa2b81d84bad441f37401d570b0f22cb2212861b_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:d4686fc27308e01125686b08c9477097fb199315ca2cf2832810e77d78ce35d3_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:f84499b6597bbbf619b26d6cef51450bf7854bbd5d5740dce20f801355d8ac7e_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:5c1edbdc79c3220f3b496ba06d0b8a256aef09844a945d08722382dfe64e799a_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:5c2b4e4d54576a3518844c0561a24aaa4c08224e10b4a0fcfa02f624c4ff9c45_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:d847b1d25a2908528190853df889f51dfcadf375aa9a6992d6b37c97f40709fe_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:71c08e15a4746c54397e5110011a6510af61aecef080682060d8f3f5ed1fbe26_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:d91b680058b5f7c7d5454d2b4acdd2fd08c2af53d3f6873eadfd3d0f935bfc66_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:f82c581c0477b1c213c60154de2160aabfabc1b40b6b8601cd20b393268a9a38_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:81058aca537a5653c2ae67651915d319edb4fab5e3121ed92bc39c2af5c297ae_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:92fe93a4fc9d2f649df854a902c49bbceb2bbe1427d7dd1fd68b755b0916a0f6_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:c151de58fecf4a8950bd7381b8e08a1938906d810a18928f34715f803aa73184_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:5370a2a72a333403ba8419d88588a9ae8cdb5a3744176b1424b97fba385bbe2c_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:63295883445663418b2189e113b5360a8e7a0de24b316f153f3d25525fd45b83_s390x as a component of Red Hat Container Native Virtualization 4.22
  • +20 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)