RHSA-2026:20825
Vulnerability from csaf_redhat - Published: 2026-05-26 11:20 - Updated: 2026-05-27 07:02Summary
Red Hat Security Advisory: OpenShift Virtualization v4.12 Images
Severity
Important
Notes
Topic: Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.
Details: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.
This advisory contains OpenShift Virtualization v4.12 images.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.
9.9 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64 | — |
Workaround
|
Threats
Impact
Important
References
8 references
Acknowledgments
Red Hat
Sarah Bennert
Stoyan Nikolov
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.12 images.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:20825",
"url": "https://access.redhat.com/errata/RHSA-2026:20825"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-7374",
"url": "https://access.redhat.com/security/cve/CVE-2026-7374"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20825.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Virtualization v4.12 Images",
"tracking": {
"current_release_date": "2026-05-27T07:02:30+00:00",
"generator": {
"date": "2026-05-27T07:02:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.1"
}
},
"id": "RHSA-2026:20825",
"initial_release_date": "2026-05-26T11:20:08+00:00",
"revision_history": [
{
"date": "2026-05-26T11:20:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-27T05:30:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-27T07:02:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Container Native Virtualization 4.12",
"product": {
"name": "Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:container_native_virtualization:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Container Native Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/libguestfs-tools@sha256%3A01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-api@sha256%3A665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375385"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-artifacts-server@sha256%3A8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375363"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-controller@sha256%3A33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-exportproxy@sha256%3Ae260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375371"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-exportserver@sha256%3A4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375384"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-handler@sha256%3A14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-launcher@sha256%3A24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375387"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64",
"product": {
"name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64",
"product_id": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/virt-operator@sha256%3A0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization\u0026tag=1779375374"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64 as a component of Red Hat Container Native Virtualization 4.12",
"product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64"
},
"product_reference": "registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64",
"relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Sarah Bennert",
"Stoyan Nikolov"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-7374",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-04-22T07:20:25+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463728"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in KubeVirt\u0027s virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host\u0027s container runtime (CRI-O) socket, an attacker can hijack virt-handler\u0027s privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important privilege escalation flaw in KubeVirt\u0027s virt-handler component. An authenticated OpenShift user with edit permissions in a single namespace can exploit improper symlink validation to hijack virt-handler\u0027s privileged connection. This allows access to any Unix socket on the host, leading to potential full control of the node and the entire cluster.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64"
],
"known_not_affected": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-7374"
},
{
"category": "external",
"summary": "RHBZ#2463728",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463728"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-7374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-7374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7374"
}
],
"release_date": "2026-05-26T12:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-26T11:20:08+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:20825"
},
{
"category": "workaround",
"details": "Update cluster RBAC to not allow exec into virt-launcher pods.",
"product_ids": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:01ba6fb5992c8507447fc076018614b3c9a2b4c1227888857accab46e285adea_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-api@sha256:665c07dd9351d2705263ab110c96daf486200f2e64fb48a6c6200140b150dec9_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:8bd5dcdc0aee994df7557314907ed546d25ae1eb49f6eb0c457b48cc4a924816_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-controller@sha256:33770e79cfcea9c72e718b4e9f4be9da3e70fc78626dbebefd714b1f24240544_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:e260b1934222a07c1261052749e58b7f156e050bf90a0edcd899df0c8f4eaee1_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:4d486fff777a3adfd6aea2ad64a0c4fa4c6a04430d64ed41f0bc9449d30c86af_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-handler@sha256:14d2ab487872ac2180a6bf413703d124e5a66063222712e0b0693d120414512d_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-launcher@sha256:24f01fa21b06e06d7104ea7c1a13671b6d45058b7b9d361e53ccb01130b95044_amd64",
"Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/virt-operator@sha256:0245d56bfcad2449c69341493ee9c856ccde11803c0df6313d638725a5cf92b9_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…