CVE-2026-9804

HIGH

Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

Title source: cna

Description

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

References (8)

Core 8

Core References

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:27914

https://access.redhat.com/errata/RHSA-2026:27914

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:27983

https://access.redhat.com/errata/RHSA-2026:27983

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:28002

https://access.redhat.com/errata/RHSA-2026:28002

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:27903

https://access.redhat.com/errata/RHSA-2026:27903

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:27913

https://access.redhat.com/errata/RHSA-2026:27913

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-9804

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2482487

https://bugzilla.redhat.com/show_bug.cgi?id=2482487

Scores

CVSS v3 7.7

EPSS 0.0052

EPSS Percentile 41.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-59

Status published

Products (8)

kubevirt.io/kubevirt 0 - 1.9.0-beta.0Go

Red Hat/Red Hat Container Native Virtualization 4.17 1781757410

Red Hat/Red Hat Container Native Virtualization 4.18 1781928221

Red Hat/Red Hat Container Native Virtualization 4.19 1781590993

Red Hat/Red Hat Container Native Virtualization 4.2 1781838712

Red Hat/Red Hat Container Native Virtualization 4.20 1781838712

Red Hat/Red Hat Container Native Virtualization 4.21 1782012918

Red Hat/Red Hat OpenShift Virtualization 4

Published May 28, 2026

Tracked Since May 28, 2026