Skip to content
fr Sign in
7.7 High

CVE-2026-17527 In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only…

Description

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Container Native Virtualization 4.18 1787586357 earliest → < 1787586357 1787586357
Red Hat Container Native Virtualization 4.19 1787234290 earliest → < 1787234290 1787234290
Red Hat Container Native Virtualization 4.20 1787231995 earliest → < 1787231995 1787231995
Red Hat Container Native Virtualization 4.21 1787235286 earliest → < 1787235286 1787235286
Red Hat Container Native Virtualization 4.22 1787295217 earliest → < 1787295217 1787295217
Red Hat Container Native Virtualization 4.16 1787585647 earliest → < 1787585647 1787585647
Red Hat Container Native Virtualization 4.14 1788157795 earliest → < 1788157795 1788157795
Red Hat Container Native Virtualization 4.2 1787231995 earliest → < 1787231995 1787231995
Show the other branch
Product Affected versions Fixed in
Red Hat Container Native Virtualization 4.17 1793257366 earliest → < 1793257366 1793257366

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Virtualization 4

The 96 CVEs of Red Hat OpenShift Virtualization 4 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-102623 A flaw was found in KubeVirt 6.5 Medium CVE-2026-79699 A flaw was found in the containers/storage library 4.4 Medium
Track this CVE