Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by redhat

CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

High 7.7

In plain English

A high-severity security flaw in Red Hat Container Native Virtualization 4.17 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gokubevirt.io/kubevirtno fix listedGHSA-mpmf-3w4r-qfpf
Gokubevirt.io/kubevirtno fix listedGO-2026-5883

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Container Native Virtualization 4.17 see references
Red Hat Red Hat Container Native Virtualization 4.18 see references
Red Hat Red Hat Container Native Virtualization 4.19 see references
Red Hat Red Hat Container Native Virtualization 4.20 see references
Red Hat Red Hat Container Native Virtualization 4.21 see references
Red Hat Red Hat OpenShift Virtualization 4 see references

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References