Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
Published May 28, 2026
7.7
HIGHCVSS 3.1
EPSS 0.72%
Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Virtualization 4 | affected |
|
No data.
No data.
Red Hat Container Native Virtualization 4.17
container-native-virtualization/virt-exportserver-rhel9:1781757410
Fixed · RHSA-2026:28002
Red Hat Container Native Virtualization 4.18
container-native-virtualization/virt-exportserver-rhel9:1781928221
Fixed · RHSA-2026:27913
Red Hat Container Native Virtualization 4.19
container-native-virtualization/virt-exportserver-rhel9:1781590993
Fixed · RHSA-2026:27914
Red Hat Container Native Virtualization 4.20
container-native-virtualization/virt-exportserver-rhel9:1781838712
Fixed · RHSA-2026:27983
Red Hat Container Native Virtualization 4.21
container-native-virtualization/virt-exportserver-rhel9:1782012918
Fixed · RHSA-2026:27903
Red Hat OpenShift Virtualization 4
container-native-virtualization/virt-exportserver
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Container Native Virtualization 4.17 | container-native-virtualization/virt-exportserver-rhel9:1781757410 | Fixed | RHSA-2026:28002 |
| Red Hat Container Native Virtualization 4.18 | container-native-virtualization/virt-exportserver-rhel9:1781928221 | Fixed | RHSA-2026:27913 |
| Red Hat Container Native Virtualization 4.19 | container-native-virtualization/virt-exportserver-rhel9:1781590993 | Fixed | RHSA-2026:27914 |
| Red Hat Container Native Virtualization 4.20 | container-native-virtualization/virt-exportserver-rhel9:1781838712 | Fixed | RHSA-2026:27983 |
| Red Hat Container Native Virtualization 4.21 | container-native-virtualization/virt-exportserver-rhel9:1782012918 | Fixed | RHSA-2026:27903 |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/virt-exportserver | Affected | n/a |
kubevirt.io/kubevirt
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | kubevirt.io/kubevirt | 0 | not fixed |
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed May 30, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
May–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.72% (0.00719) | 52.25th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.42% (0.00419) | 33.25th | v5 (v2026.06.15) |
| May 28, 2026 | 0.03% (0.00026) | 7.81th | v4 (v2025.03.14) |
References (12)
- https://access.redhat.com/errata/RHSA-2026:27903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27913 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27914 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27983 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28002 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9804 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2482487 issue-trackingx_refsource_REDHATIssue Tracking
- https://github.com/advisories/GHSA-mpmf-3w4r-qfpf Advisory
- https://github.com/kubevirt/kubevirt/commit/6ea563fa94d8ca803f8dd9394cefd8cae36bb0ee
- https://nvd.nist.gov/vuln/detail/CVE-2026-9804
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json
- https://www.cve.org/CVERecord?id=CVE-2026-9804
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:27903 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:27913 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:27914 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:27983 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:28002 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/security/cve/CVE-2026-9804 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482487 | issue-trackingx_refsource_REDHATIssue Tracking | |
| https://github.com/advisories/GHSA-mpmf-3w4r-qfpf | Advisory | |
| https://github.com/kubevirt/kubevirt/commit/6ea563fa94d8ca803f8dd9394cefd8cae36bb0ee | ||
| https://nvd.nist.gov/vuln/detail/CVE-2026-9804 | ||
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json | ||
| https://www.cve.org/CVERecord?id=CVE-2026-9804 |
Change history (0)
No recorded changes yet.