Skip to content
Fencer Intel
high 7.7

CVE-2026-9804 json

Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

published 5mo ago modified 16d ago also GHSA-mpmf-3w4r-qfpf , GO-2026-5883 , EUVD-2026-32748

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Patch / fix

  • Red Hat Red Hat Container Native Virtualization 4.17 1781757410
  • Red Hat Red Hat Container Native Virtualization 4.18 1781928221
  • Red Hat Red Hat Container Native Virtualization 4.19 1781590993
  • Red Hat Red Hat Container Native Virtualization 4.20 1781838712
  • Red Hat Red Hat Container Native Virtualization 4.21 1782012918
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.27.1
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.10.1

suse advisories SUSE-SU-2026:2804-1SUSE-SU-2026:2783-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.3-1.1
  • kubevirt-1.8 openSUSE Tumbleweed 1.8.3-1.1
  • kubevirt openSUSE Tumbleweed 1.8.3-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:11091-1openSUSE-SU-2026:11057-1openSUSE-SU-2026:11015-1

  • kubevirt Azure Linux 3.0 1.8.4-1

azure linux advisories AZL-89196

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-9804 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9804 updated cvss 7.7

kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read

  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-exportserver
    affected: no fix available
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-exportserver-rhel9 1781757410
    fixed: vendor fix RHSA-2026:28002
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-exportserver-rhel9 1781928221
    fixed: vendor fix RHSA-2026:27913
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-exportserver-rhel9 1781590993
    fixed: vendor fix RHSA-2026:27914
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-exportserver-rhel9 1781838712
    fixed: vendor fix RHSA-2026:27983
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-exportserver-rhel9 1782012918
    fixed: vendor fix RHSA-2026:27903
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-api-rhel9 1781757411, container-native-virtualization/pr-helper-rhel9 1781757371, container-native-virtualization/sidecar-shim-rhel9 1781757411, container-native-virtualization/virt-handler-rhel9 1781757460, container-native-virtualization/virt-launcher-rhel9 1781757489, container-native-virtualization/virt-operator-rhel9 1781757476, +6 more Red Hat Container Native Virtualization 4.18 container-native-virtualization/virt-api-rhel9 1781928220, container-native-virtualization/pr-helper-rhel9 1781928190, container-native-virtualization/sidecar-shim-rhel9 1781928220, container-native-virtualization/virt-handler-rhel9 1781928221, container-native-virtualization/virt-launcher-rhel9 1781928236, container-native-virtualization/virt-operator-rhel9 1781928217, +6 more Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-api-rhel9 1781593002, container-native-virtualization/pr-helper-rhel9 1781590955, container-native-virtualization/sidecar-shim-rhel9 1781592111, container-native-virtualization/virt-handler-rhel9 1781591165, container-native-virtualization/virt-launcher-rhel9 1781591067, container-native-virtualization/virt-operator-rhel9 1781591030, +6 more Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-api-rhel9 1781838712, container-native-virtualization/pr-helper-rhel9 1781838771, container-native-virtualization/sidecar-shim-rhel9 1781838810, container-native-virtualization/virt-handler-rhel9 1781838849, container-native-virtualization/virt-launcher-rhel9 1781838767, container-native-virtualization/virt-operator-rhel9 1781838761, +7 more Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-api-rhel9 1782012917, container-native-virtualization/pr-helper-rhel9 1782012939, container-native-virtualization/sidecar-shim-rhel9 1782013394, container-native-virtualization/virt-handler-rhel9 1782012921, container-native-virtualization/virt-launcher-rhel9 1782012945, container-native-virtualization/virt-operator-rhel9 1782012917, +7 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CISA ADP 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go kubevirt.io/kubevirt
<=1.9.0-beta.0
all versions
 no fix listed

Affected products

  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat OpenShift Virtualization 4

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.