CVE-2026-9804: Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-10-26
Weakness: CWE-59

Description

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Affected products

Red Hat Container Native Virtualization 4.17: all versions — fixed in 1781757410
Red Hat Container Native Virtualization 4.18: all versions — fixed in 1781928221
Red Hat Container Native Virtualization 4.19: all versions — fixed in 1781590993
Red Hat Container Native Virtualization 4.20: all versions — fixed in 1781838712
Red Hat Container Native Virtualization 4.21: all versions — fixed in 1782012918
Red Hat OpenShift Virtualization 4: all versions

How to fix

Upgrade to a fixed version: Red Hat Container Native Virtualization 4.17 1781757410; Red Hat Container Native Virtualization 4.18 1781928221; Red Hat Container Native Virtualization 4.19 1781590993; Red Hat Container Native Virtualization 4.20 1781838712; Red Hat Container Native Virtualization 4.21 1782012918. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-9804 or the next vulnerability affects your stack