Riskcovery

CVE-2025-14459

Virt-cdi-controller: unauthorized pvc cloning via dataimportcron

State
Published
Severity
8.5 High
Published
Jan 26, 2026
Updated
Jul 15, 2026
Reserved
Dec 10, 2025

Read the record on cve.org

Description

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.

Scores

CVSSScoreVectorSource
3.18.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:Nredhat
3.18.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:Nredhat-SADP

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-4 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-3 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17.rhel9-82 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-4 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-4 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-4 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-7 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-7 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-6 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-85 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-11 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-19 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-88 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-8 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-8 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-8 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-7 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-7 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-7 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-8 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-8 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-4 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-9 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-12 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
RHEL-9-CNV-4.19Red Hat
  • v4.19.17-5 and laterNot affected
Red Hat OpenShift Virtualization 4Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.