Skip to contentRed Hat Container Native Virtualization 4.20 vulnerabilities
- red hat container native virtualization 4.12, container native virtualization 4.13, container native virtualization 4.14 +8 more +10 moreKubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to hostCVE-2026-13622Fix available8.8 High
- red hat container native virtualization 4.14, container native virtualization 4.16, container native virtualization 4.17 +6 more +8 moreVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc cloneCVE-2026-175277.7 High
- kubevirt, red hat container native virtualization 4.12, container native virtualization 4.13 +10 more +12 moreKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionCVE-2026-13201Fix available7.3 High
- red hat container native virtualization 4.17, container native virtualization 4.18, container native virtualization 4.19 +3 more +5 moreKubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readCVE-2026-9804Fix available7.7 High
- red hat container native virtualization 4.12, container native virtualization 4.13, container native virtualization 4.14 +7 more +9 moreKubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerabilityCVE-2026-7374Fix available9.9 Critical
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-44990Fix available9.3 Critical
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRICVE-2026-35469Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical