Skip to content
Fencer Vulns
high 7.7

CVE-2026-17527 json

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

published 2026-07-27 3 mo ago modified 2026-11-03 6 d ago also EUVD-2026-49135

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

Patch / fix

  • Red Hat Red Hat Container Native Virtualization 4.14 1788157795
  • Red Hat Red Hat Container Native Virtualization 4.16 1787585647
  • Red Hat Red Hat Container Native Virtualization 4.17 1793257366
  • Red Hat Red Hat Container Native Virtualization 4.18 1787586357
  • Red Hat Red Hat Container Native Virtualization 4.19 1787234290
  • Red Hat Red Hat Container Native Virtualization 4.20 1787231995
  • Red Hat Red Hat Container Native Virtualization 4.21 1787235286
  • Red Hat Red Hat Container Native Virtualization 4.22 1787295217

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-17527 updated cvss 7.7

virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone

  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-cdi-operator
    affected: workaround, no fix available
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-cdi-operator-rhel9 1788157795
    fixed: vendor fix RHSA-2026:62599
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-cdi-operator-rhel9 1787585647
    fixed: vendor fix RHSA-2026:61666
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-cdi-operator-rhel9 1793257366
    fixed: vendor fix RHSA-2026:93958
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-cdi-operator-rhel9 1787586357
    fixed: vendor fix RHSA-2026:60301
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-cdi-operator-rhel9 1787234290
    fixed: vendor fix RHSA-2026:59109
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-cdi-operator-rhel9 1787231995
    fixed: vendor fix RHSA-2026:59083
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-cdi-operator-rhel9 1787235286
    fixed: vendor fix RHSA-2026:59062
show 2 more
  • Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-cdi-operator-rhel9 1787295217
    fixed: vendor fix RHSA-2026:60117
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization/virt-cdi-cloner-rhel9 1788157779, container-native-virtualization/virt-cdi-importer-rhel9 1788157802, container-native-virtualization/virt-cdi-apiserver-rhel9 1788157766, container-native-virtualization/virt-cdi-controller-rhel9 1788157775, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1788157761, container-native-virtualization/virt-cdi-uploadserver-rhel9 1788157836 Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-cdi-cloner-rhel9 1787586119, container-native-virtualization/virt-cdi-importer-rhel9 1787585650, container-native-virtualization/virt-cdi-apiserver-rhel9 1787585670, container-native-virtualization/virt-cdi-controller-rhel9 1787586053, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787585987, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787585641 Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-cdi-cloner-rhel9 1793257158, container-native-virtualization/virt-cdi-importer-rhel9 1793257586, container-native-virtualization/virt-cdi-apiserver-rhel9 1793257203, container-native-virtualization/virt-cdi-controller-rhel9 1793257039, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1793257036, container-native-virtualization/virt-cdi-uploadserver-rhel9 1793257049 Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-cdi-cloner-rhel9 1787585816, container-native-virtualization/virt-cdi-importer-rhel9 1787586102, container-native-virtualization/virt-cdi-apiserver-rhel9 1787586592, container-native-virtualization/virt-cdi-controller-rhel9 1787586814, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787586844, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787587083 Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-cdi-cloner-rhel9 1787232439, container-native-virtualization/virt-cdi-importer-rhel9 1787235477, container-native-virtualization/virt-cdi-apiserver-rhel9 1787242757, container-native-virtualization/virt-cdi-controller-rhel9 1787233642, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787234916, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787237523 Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-cdi-cloner-rhel9 1787235528, container-native-virtualization/virt-cdi-importer-rhel9 1787233467, container-native-virtualization/virt-cdi-apiserver-rhel9 1787233052, container-native-virtualization/virt-cdi-controller-rhel9 1787233044, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787232525, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787233905
    +2 more products
    Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-cdi-cloner-rhel9 1787232589, container-native-virtualization/virt-cdi-importer-rhel9 1787238164, container-native-virtualization/virt-cdi-apiserver-rhel9 1787231965, container-native-virtualization/virt-cdi-controller-rhel9 1787232221, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787232781, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787234707 Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-cdi-cloner-rhel9 1787238152, container-native-virtualization/virt-cdi-importer-rhel9 1787236133, container-native-virtualization/virt-cdi-apiserver-rhel9 1787240009, container-native-virtualization/virt-cdi-controller-rhel9 1787239422, container-native-virtualization/virt-cdi-uploadproxy-rhel9 1787232196, container-native-virtualization/virt-cdi-uploadserver-rhel9 1787233675
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat Container Native Virtualization 4.14
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat Container Native Virtualization 4.22
  • Red Hat Red Hat OpenShift Virtualization 4

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.