PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9804 Red Hat CVE debrief

A path traversal vulnerability in KubeVirt's virt-exportserver component allows attackers with namespace-level access to read arbitrary files from the exporter pod's filesystem. The flaw exists in the VMExport directory endpoint, where a symbolic link placed within an exported filesystem Persistent Volume Claim (PVC) can point outside its designated mount root. This information disclosure vulnerability has a CVSS 3.1 score of 7.7 (HIGH) and was published on May 28, 2026. The weakness is classified as CWE-59 (Improper Link Resolution Before File Access).

Vendor
Red Hat
Product
Red Hat OpenShift Virtualization 4
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-08-24
Advisory published
2026-05-28
Advisory updated
2026-08-24

Who should care

Organizations running KubeVirt for virtual machine management on Kubernetes, particularly those using the VMExport functionality for disk exports. Platform engineers, Kubernetes cluster administrators, and security teams responsible for containerized virtualization environments should prioritize assessment.

Technical summary

The virt-exportserver component in KubeVirt fails to properly validate symbolic links within exported filesystem PVCs. An attacker with namespace-level access can create a symlink in a PVC that resolves outside the mount root, causing the export endpoint to follow the link and expose arbitrary files from the exporter pod's filesystem. The vulnerability is triggered through the VMExport directory endpoint and results in information disclosure without affecting integrity or availability.

Defensive priority

HIGH

Recommended defensive actions

  • Review KubeVirt VMExport configurations and restrict namespace-level access to the virt-exportserver component
  • Audit Persistent Volume Claims for unexpected symbolic links before export operations
  • Apply security patches from KubeVirt/Red Hat when available
  • Monitor virt-exportserver pod filesystem access for anomalous read patterns
  • Implement admission controls to prevent PVCs with suspicious symlink configurations from being exported

Evidence notes

The vulnerability description is sourced from the NVD record with references to Red Hat's security advisory and Bugzilla entry. The CVSS vector confirms network attack vector with low attack complexity, low privileges required, and high confidentiality impact on changed scope.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9804 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9804

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9804 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9804

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.