Red Hat OpenShift Virtualization Updates Address Four Flaws
Tech GuruQuick Answer
Red Hat has issued OpenShift Virtualization image updates for the listed 4.12, 4.14 and 4.16 streams. The fixed artifacts are specific console-plugin and kubemacpool images; the stream label alone is not proof that those images have been replaced.
Confirm Scope And Apply The Supported Fix
What to do now: Identify the Virtualization stream, architecture and installed console-plugin/kubemacpool image digests. Apply prerequisite errata and the supported component update for that stream.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OpenShift Virtualization 4.12, 4.14, and 4.16 image streams |
|---|---|
| Advisory | RHSA-2026:69998 / RHSA-2026:70006 / RHSA-2026:70027 / RHSA-2026:70047 |
| CVEs | CVE-2026-33818, CVE-2026-56859, CVE-2026-56860, CVE-2026-84375 |
| Authoritative release date | RHSA-2026:69998: 2026-09-22T09:59:52+00:00 (CSAF initial release) RHSA-2026:70006: 2026-09-22T10:01:59+00:00 (CSAF initial release) RHSA-2026:70027: 2026-09-22T10:05:31+00:00 (CSAF initial release) RHSA-2026:70047: 2026-09-22T10:10:30+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69998: 2026-09-22T09:59:58+00:00 (CSAF revision history) RHSA-2026:70006: 2026-09-22T10:02:04+00:00 (CSAF revision history) RHSA-2026:70027: 2026-09-22T10:05:37+00:00 (CSAF revision history) RHSA-2026:70047: 2026-09-22T10:10:31+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled OpenShift Virtualization 4.12, 4.14, and 4.16 image streams builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | Use the fixed registry digests in the corresponding advisory: 4.14 kubevirt-console-plugin-rhel9: RHSA-2026:69998, amd64/arm64.4.14 kubemacpool-rhel9: :70006, amd64/arm64.4.16 kubevirt-console-plugin-rhel9: :70027, amd64/arm64.4.12 kubevirt-console-plugin: :70047, amd64.Branch labels 4.12/4.14/4.16 are not exact fixed-build identifiers; match the image digest for each installed component. |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The four Virtualization advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
Three advisories address js-yaml denial of service in console-plugin images. The separate 4.14 kubemacpool advisory addresses Go ASN.1, XML and URL resource-exhaustion flaws. These updates concern virtualization platform components, not a claim that every guest operating system is patched.
What To Validate Now
- Inventory. Locate OpenShift Virtualization 4.12, 4.14, and 4.16 image streams deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled OpenShift Virtualization 4.12, 4.14, and 4.16 image streams builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Apply all relevant prerequisite errata, then use the supported Virtualization update channel to deploy the advisory-listed fixed component images. Do not mix image digests between streams or architectures.
- Validate. Verify the new running component image digests and operator health, then test console access, VM creation/start and relevant networking or migration workflows. Assess guest OS updates independently.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
