CVE-2026-9804
Full vulnerability record from the local CVENow database.
Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
Severity
HIGH
CVSS score
7.7
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-05-28 09:16:49.500000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-9804",
"sourceIdentifier": "[email protected]",
"published": "2026-05-28T09:16:49.500",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data."
},
{
"lang": "es",
"value": "Se encontró una falla en el componente virt-exportserver de KubeVirt. Un atacante con acceso específico a nivel de namespace puede explotar una vulnerabilidad de salto de ruta en el endpoint de directorio VMExport. Al colocar un enlace simbólico (symlink) dentro de un Persistent Volume Claim (PVC) de sistema de archivos exportado que apunta fuera de su raíz de montaje designada, el atacante puede leer archivos arbitrarios del sistema de archivos del pod exportador. Esto conduce a la revelación de información, exponiendo potencialmente datos sensibles."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.17::el9"
],
"versions": [
{
"version": "1781757410",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.18",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.18::el9"
],
"versions": [
{
"version": "1781928221",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.19",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.19::el9"
],
"versions": [
{
"version": "1781590993",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.20",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.20::el9"
],
"versions": [
{
"version": "1781838712",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.21",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.21::el9"
],
"versions": [
{
"version": "1782012918",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-exportserver",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.17::el9"
],
"versions": [
{
"version": "1781757410",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.18",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.18::el9"
],
"versions": [
{
"version": "1781928221",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.19",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.19::el9"
],
"versions": [
{
"version": "1781590993",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.20",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.20::el9"
],
"versions": [
{
"version": "1781838712",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Container Native Virtualization 4.21",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "container-native-virtualization/virt-exportserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.21::el9"
],
"versions": [
{
"version": "1782012918",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-exportserver",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-30T01:54:32.833433Z",
"id": "CVE-2026-9804",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:27903",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27913",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27914",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27983",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:28002",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-9804",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482487",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27903",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27913",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27914",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:27983",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:28002",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-9804",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482487",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}