Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-17527— Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

Quick assessment

Affected
Red Hat Red Hat Container Native Virtualization 4.14
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

KubeVirt containerized data importer是KubeVirt组织开源的一个容器化数据导入工具。 KubeVirt Containerized Data Importer存在授权问题漏洞，该漏洞源于cdi.kubevirt.io:view ClusterRole的权限规则不当，允许具有view角色的用户或服务账户通过DataVolume克隆授权绕过命名空间隔离和只读保证，从而泄露集群中任意PVC的内容。

CVSS 7.7 · High EPSS 0.57% · P45
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17527

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone
Source: CVE Program / CVE List V5
Vulnerability Description
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
KubeVirt Containerized Data Importer 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
KubeVirt containerized data importer是KubeVirt组织开源的一个容器化数据导入工具。 KubeVirt Containerized Data Importer存在授权问题漏洞，该漏洞源于cdi.kubevirt.io:view ClusterRole的权限规则不当，允许具有view角色的用户或服务账户通过DataVolume克隆授权绕过命名空间隔离和只读保证，从而泄露集群中任意PVC的内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Container Native Virtualization 4.14 1788157795 ~ * cpe:/a:redhat:container_native_virtualization:4.14::el9
Red Hat Red Hat Container Native Virtualization 4.16 1787585647 ~ * cpe:/a:redhat:container_native_virtualization:4.16::el9
Red Hat Red Hat Container Native Virtualization 4.18 1787586357 ~ * cpe:/a:redhat:container_native_virtualization:4.18::el9
Red Hat Red Hat Container Native Virtualization 4.19 1787234290 ~ * cpe:/a:redhat:container_native_virtualization:4.19::el9
Red Hat Red Hat Container Native Virtualization 4.20 1787231995 ~ * cpe:/a:redhat:container_native_virtualization:4.20::el9
Red Hat Red Hat Container Native Virtualization 4.21 1787235286 ~ * cpe:/a:redhat:container_native_virtualization:4.21::el9
Red Hat Red Hat Container Native Virtualization 4.22 1787295217 ~ * cpe:/a:redhat:container_native_virtualization:4.22::el9
Red Hat Red Hat OpenShift Virtualization 4 - cpe:/a:redhat:container_native_virtualization:4

II. Public POCs for CVE-2026-17527

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17527

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-17527 (9)

Same Patch Batch · Red Hat · 2026-07-27 · 3 CVEs total

CVE-2026-12383 7.5 HIGH Eda-server: externaleventstreamviewset trusts subject header without validation and leaks
CVE-2026-15003 5.6 MEDIUM Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and

IV. Related Vulnerabilities

Same vendor: Red Hat
Same weakness: CWE-639

V. Comments for CVE-2026-17527

No comments yet

Leave a comment