Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-14459— Virt-cdi-controller: unauthorized pvc cloning via dataimportcron

Quick assessment

Affected
Red Hat RHEL-9-CNV-4.19
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat OpenShift Virtualization 4是美国红帽（Red Hat）公司的一个虚拟机管理组件。 Red Hat OpenShift Virtualization 4存在安全漏洞，该漏洞源于未经授权的PVC克隆。

CVSS 8.5 · High EPSS 0.38% · P29

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 55

VendorProduct Version RangeStatus
Red Hat Red Hat OpenShift Virtualization 4 any unaffected
Red Hat RHEL-9-CNV-4.19 v4.19.17-5< * unaffected
v4.19.17-5< * unaffected
v4.19.17-5< * unaffected
v4.19.17-5< * unaffected
v4.19.17-5< * unaffected
v4.19.17-4< * unaffected
v4.19.17-3< * unaffected
v4.19.17.rhel9-82< * unaffected
… +46 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-14459

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Virt-cdi-controller: unauthorized pvc cloning via dataimportcron
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat OpenShift Virtualization 4 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat OpenShift Virtualization 4是美国红帽（Red Hat）公司的一个虚拟机管理组件。 Red Hat OpenShift Virtualization 4存在安全漏洞，该漏洞源于未经授权的PVC克隆。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-4 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-3 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17.rhel9-82 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-4 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-4 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-4 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-7 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-7 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-6 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-85 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-9 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-11 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-9 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-5 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat RHEL-9-CNV-4.19 v4.19.17-19 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9

II. Public POCs for CVE-2025-14459

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-14459

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-14459 (2)

Same Patch Batch · Red Hat · 2026-01-26 · 5 CVEs total

CVE-2025-14525 6.4 MEDIUM Kubevirt: kubevirt: vm administration denial of service via guest agent
CVE-2025-14969 4.3 MEDIUM Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on h
CVE-2026-1190 3.1 LOW Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked n
CVE-2025-9615 Networkmanager: networkmanager file access

IV. Related Vulnerabilities

Same vendor: Red Hat
Same weakness: CWE-639

V. Comments for CVE-2025-14459

No comments yet

Leave a comment