VDB

CVE-2026-9804

CVE-2026-9804 PUBLISHED CVSS 7.7 HIGH

Reported by redhat · Published May 28, 2026

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Risk Scores

CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Container Native Virtualization 4.171781757410
Red HatRed Hat Container Native Virtualization 4.181781928221
Red HatRed Hat Container Native Virtualization 4.191781590993
Red HatRed Hat Container Native Virtualization 4.201781838712
Red HatRed Hat Container Native Virtualization 4.211782012918
Red HatRed Hat OpenShift Virtualization 4
chainguarddocker-machine-driver-harvester0
Red HatRed Hat Container Native Virtualization 4.181781928221, 1781928221, 1781928221
chainguardvirt-handler-1.8*, *, *
Red HatRed Hat OpenShift Virtualization 4
chainguardvirt-controller-fips-1.7*, *, *
chainguardvirt-operator-1.7*, *, *
chainguardvirt-operator-fips-1.8*, *, *
Red HatRed Hat OpenShift Virtualization 4
chainguardvirt-handler-fips-1.7*, *, *
Red HatRed Hat Container Native Virtualization 4.201781838712, 1781838712, 1781838712
Red HatRed Hat OpenShift Virtualization 4
chainguardvirt-api-fips-1.7*, *, *
chainguardvirt-api-fips-1.6*, *, *
Red HatRed Hat Container Native Virtualization 4.181781928221, 1781928221, 1781928221

…and 33 more

Timeline

  • May 28, 2026 CVE Published
  • May 28, 2026 EPSS Score
  • May 29, 2026 EPSS Score
  • May 30, 2026 EPSS Score
  • May 30, 2026 Coalition ESS Score
  • May 31, 2026 EPSS Score
  • Jun 1, 2026 EPSS Score
  • Jun 2, 2026 Security Advisory
  • Jun 5, 2026 EPSS Score
  • Aug 7, 2026 EPSS Score
  • Aug 18, 2026 Distribution Patch
  • Aug 18, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›