A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not deter…

published 2019-06-28 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2203

cvss: 6.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10175 updated 2026-02-20 cvss 6.5

containerized-data-importer: Exposed read access to all storage currently allocated to PVCs regardless of namespace

Red Hat OpenShift Virtualization 1 virt-cdi-cloner
affected: no fix planned “Will not fix”
Red Hat OpenShift Virtualization 2 virt-cdi-cloner
affected: no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

KubeVirt containerized-data-importer

Classification

Weakness

CWE-284 Improper Access Control
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-862 Missing Authorization

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10175
issue-tracking, third-party-advisory

Sources

CVE List CVE-2019-10175
NVD CVE-2019-10175

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary