What’s Vulnerable › Products

Red Hat OpenShift Virtualization 4 vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your Red Hat OpenShift Virtualization 4 version is affected

Latest Red Hat OpenShift Virtualization 4 vulnerabilities

• CVE-2026-102623 — Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume (CVSS 6.5)
• CVE-2026-79705 — Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers (CVSS 4.5)
• CVE-2026-79699 — Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory (CVSS 4.4)
• CVE-2026-17527 — Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone (CVSS 7.7)
• CVE-2026-9804 — Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read (CVSS 7.7)
• CVE-2026-6383 — Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation (CVSS 5.4)
• CVE-2025-14525 — Kubevirt: kubevirt: vm administration denial of service via guest agent (CVSS 6.4)
• CVE-2025-57848 — Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4)
• CVE-2025-7195 — Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd (CVSS 6.4)
• CVE-2025-8556 — Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results (CVSS 3.7)
• CVE-2024-9355 — Golang-fips: golang fips zeroed buffer (CVSS 6.5)
• CVE-2024-4467 — Qemu-kvm: 'qemu-img info' leads to host file read/write (CVSS 7.8)
• CVE-2024-3727 — Containers/image: digest type does not guarantee valid type (CVSS 8.3)
• CVE-2024-31419 — Cnv: information disclosure through the usage of vm-dump-metrics (CVSS 4.3)