CVE-2026-9804
Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
- State
- Published
- Severity
- 7.7 High
- Published
- May 28, 2026
- Updated
- Sep 10, 2026
- Reserved
- May 28, 2026
Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat-SADP |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
Red Hat Container Native Virtualization 4.17Red Hat |
|
Red Hat Container Native Virtualization 4.18Red Hat |
|
Red Hat Container Native Virtualization 4.19Red Hat |
|
Red Hat Container Native Virtualization 4.20Red Hat |
|
Red Hat Container Native Virtualization 4.21Red Hat |
|
Red Hat OpenShift Virtualization 4Red Hat |
References
- RHSA-2026:27903vendor-advisory
- RHSA-2026:27913vendor-advisory
- RHSA-2026:27914vendor-advisory
- RHSA-2026:27983vendor-advisory
- RHSA-2026:28002vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-9804vdb-entry
- RHBZ#2482487issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.