8.5 High

CVE-2025-14459 A flaw was found in KubeVirt Containerized Data Importer (CDI)

Description

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.

Affected products and versions

Product	Affected versions	Fixed in
RHEL-9-CNV-4.19 4.19	earliest → < 4.19.17-5	4.19.17-5
Red Hat OpenShift Virtualization 4	Versions not published
CNV 4.19 for RHEL 9	Versions not published

References

RHSA-2026:0950 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2420938 bugzilla.redhat.com

Timeline

Published January 26, 2026
Last modified July 15, 2026

The 2 CVEs of RHEL-9-CNV-4.19 →

CVE-2025-57848 A container privilege escalation flaw was found in certain Container-native Virtualization images 6.4 Medium

Track this CVE

CVE-2025-14459 A flaw was found in KubeVirt Containerized Data Importer (CDI)

Description

Affected products and versions

References

Timeline

Other CVEs of RHEL-9-CNV-4.19