VDB

RHSA-2026:60146

RHSA-2026:60146 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

Risk Scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:5c2b4e4d54576a3518844c0561a24aaa4c08224e10b4a0fcfa02f624c4ff9c45_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:8ad111e533ddddbecf1c7bc54564d86a5b02d121c8cf8e739754867e27b38225_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:dcc685a67056c08568364d6d82e79099b3397f7f7bed16266d32c321bb1e59d9_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:92fe93a4fc9d2f649df854a902c49bbceb2bbe1427d7dd1fd68b755b0916a0f6_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:79b185f2a797ad2467373784cacb585292d2618f8e0f08ec722b075ed708787f_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:08a7004f1b560764f8182d665d1562f6a8ef43a5372795cf2b997b38393e573c_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:63295883445663418b2189e113b5360a8e7a0de24b316f153f3d25525fd45b83_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:2599dd11af99512e90f0e7788ea7abf10a0d1497979e461ada4f1cd6734020c6_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:d847b1d25a2908528190853df889f51dfcadf375aa9a6992d6b37c97f40709fe_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:f82c581c0477b1c213c60154de2160aabfabc1b40b6b8601cd20b393268a9a38_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:9a43076256f148e4686d791d4bb4e51b8e59464ace84ddf4afdba800e8bd301f_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-synchronization-controller-rhel9@sha256:d0752647d9f7ad45a9a74c618ec866d667e9e976dc5c720e2dd9b9c09b25fb3d_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:d91b680058b5f7c7d5454d2b4acdd2fd08c2af53d3f6873eadfd3d0f935bfc66_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:52916f7c61840af209599959fa2b81d84bad441f37401d570b0f22cb2212861b_s390x as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:1dabd5163ce75e8200ac8d015bce1f90882b6f9b2f77c686a5ac79767d381913_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-synchronization-controller-rhel9@sha256:063ea27f5d7e9a49a82a49435aff2eed69d005359cbc0f47ffeb4f6984f961eb_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:a98165e4a4aa54c08c96aab5507db142b637d033e7d933f2e864007255e73780_amd64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:58600b84cc50fece033c92aa1726a63b961783f89f30dd273b2fbbc0c3ad1a57_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:d28257de59363f61e3b5384a2670431e5995eecc43e8f3bb10aa150ea6b7ef7f_arm64 as a component of Red Hat Container Native Virtualization 4.22*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:4832fe439ca47545e884dc55fb9c54facef6e571bd9b42adc7fa2a15170b30fc_s390x as a component of Red Hat Container Native Virtualization 4.22*

…and 29 more

Timeline

  • Aug 26, 2026 CVE Published
  • Sep 19, 2026 CVE Updated
  • Sep 19, 2026 Distribution Patch
  • Sep 19, 2026 Distribution Patch
  • Sep 19, 2026 Security Advisory
  • Sep 19, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›