Aller au contenu
en Se connecter
7.7 Élevée

CVE-2026-17527 In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only…

Description

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat OpenShift Virtualization 4 Versions non publiées
Red Hat Container Native Virtualization 4.18 1787586357 premières → < 1787586357 1787586357
Red Hat Container Native Virtualization 4.19 1787234290 premières → < 1787234290 1787234290
Red Hat Container Native Virtualization 4.20 1787231995 premières → < 1787231995 1787231995
Red Hat Container Native Virtualization 4.21 1787235286 premières → < 1787235286 1787235286
Red Hat Container Native Virtualization 4.22 1787295217 premières → < 1787295217 1787295217
Red Hat Container Native Virtualization 4.16 1787585647 premières → < 1787585647 1787585647
Red Hat Container Native Virtualization 4.14 1788157795 premières → < 1788157795 1788157795
Red Hat Container Native Virtualization 4.2 1787231995 premières → < 1787231995 1787231995
Afficher l’autre branche
Produit Versions touchées Corrigé en
Red Hat Container Native Virtualization 4.17 1793257366 premières → < 1793257366 1793257366

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat OpenShift Virtualization 4

Les 96 CVE de Red Hat OpenShift Virtualization 4 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Moyenne CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 Élevée CVE-2026-102623 A flaw was found in KubeVirt 6.5 Moyenne CVE-2026-79699 A flaw was found in the containers/storage library 4.4 Moyenne
Suivre cette CVE