Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Container Native Virtualization 4.17 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — | — |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kubevirt | 1.7.4-150700.3.27.1 | SUSE-SU-2026:2804-1 |
| SLES 15 SP7 | kubevirt-1.6 | 1.6.6-150700.15.10.1 | SUSE-SU-2026:2783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kubevirt +2 | 1.8.3-1.1 | openSUSE-SU-2026:11091-1, openSUSE-SU-2026:11057-1, openSUSE-SU-2026:11015-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.8.4-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-machine-driver-harvester | 1.1.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | kubevirt.io/kubevirt | <= 1.9.0-beta.0 | — | GHSA-mpmf-3w4r-qfpf |
| Go | kubevirt.io/kubevirt | all versions | — | GO-2026-5883 |
Advisories 6
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:2783-1 Security update for kubevirt-1.6 SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:2804-1 Security update for kubevirt SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:11091-1 kubevirt1.8-container-disk-1.8.3-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:11057-1 kubevirt-1.8-container-disk-1.8.3-1.1 on GA media SUSE / openSUSE Security Updates · Jun 19, 2026
- openSUSE-SU-2026:11015-1 kubevirt-container-disk-1.8.3-1.1 on GA media SUSE / openSUSE Security Updates · Jun 13, 2026
References
- RHSA-2026:27903 vendor-advisory
- RHSA-2026:27913 vendor-advisory
- RHSA-2026:27914 vendor-advisory
- RHSA-2026:27983 vendor-advisory
- RHSA-2026:28002 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-9804 vdb-entry
- RHBZ#2482487 issue-tracking