Authorization bypass in Red Hat Container Native Virtualization 4.14
Priority LOW 34CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-639.
Summary
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Partial Red Hat: 8 advisoriesRed Hat: 8 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Container Native Virtualization 4.14 | — | 1788157795 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.16 | — | 1787585647 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.17 | — | 1793257366 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — | 1787586357 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — | 1787234290 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — | 1787231995 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — | 1787235286 | Patch available | CNA |
| Red Hat | Red Hat Container Native Virtualization 4.22 | — | 1787295217 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — | No fix listed | CNA |
- Red Hat Container Native Virtualization 4.14 VendorRed Hat Affected — Fixed in 1788157795 Patch available CNA
- Red Hat Container Native Virtualization 4.16 VendorRed Hat Affected — Fixed in 1787585647 Patch available CNA
- Red Hat Container Native Virtualization 4.17 VendorRed Hat Affected — Fixed in 1793257366 Patch available CNA
- Red Hat Container Native Virtualization 4.18 VendorRed Hat Affected — Fixed in 1787586357 Patch available CNA
- Red Hat Container Native Virtualization 4.19 VendorRed Hat Affected — Fixed in 1787234290 Patch available CNA
- Red Hat Container Native Virtualization 4.20 VendorRed Hat Affected — Fixed in 1787231995 Patch available CNA
- Red Hat Container Native Virtualization 4.21 VendorRed Hat Affected — Fixed in 1787235286 Patch available CNA
- Red Hat Container Native Virtualization 4.22 VendorRed Hat Affected — Fixed in 1787295217 Patch available CNA
- Red Hat OpenShift Virtualization 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:container_native_virtualization:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.17::el9 | 4.17 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.21::el9 | 4.21 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:container_native_virtualization:4 | 4 | — | Red Hat |
- cpe:/a:redhat:container_native_virtualization:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.17::el9 Versions 4.17 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.21::el9 Versions 4.21 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:container_native_virtualization:4 Versions 4 — ·Red Hat
Remediation
Red Hat 8 advisories
- RHSA-2026:93958 Released 2026-11-02 · Red Hat rating ImportantOpenShift Virtualization v4.17 Images
- Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:62599 Released 2026-09-02 · Red Hat rating ImportantOpenShift Virtualization v4.14 Images
- Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:61666 Released 2026-08-31 · Red Hat rating ImportantOpenShift Virtualization v4.16 Images
- Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
Show 5 more Red Hat advisories
- RHSA-2026:60301 Released 2026-08-26 · Red Hat rating ImportantOpenShift Virtualization v4.18 Images
- Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:60117 Released 2026-08-26 · Red Hat rating ImportantOpenShift Virtualization v4.22 Images
- Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:59109 Released 2026-08-24 · Red Hat rating ImportantOpenShift Virtualization v4.19 Images
- Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:59083 Released 2026-08-24 · Red Hat rating ImportantOpenShift Virtualization v4.20 Images
- Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
- RHSA-2026:59062 Released 2026-08-24 · Red Hat rating ImportantOpenShift Virtualization v4.21 Images
- Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/virt-cdi-operator-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Container Native Virtualization 4.14 | Fixed | RHSA-2026:62599 |
| Red Hat Container Native Virtualization 4.16 | Fixed | RHSA-2026:61666 |
| Red Hat Container Native Virtualization 4.17 | Fixed | RHSA-2026:93958 |
| Red Hat Container Native Virtualization 4.18 | Fixed | RHSA-2026:60301 |
| Red Hat Container Native Virtualization 4.19 | Fixed | RHSA-2026:59109 |
| Red Hat Container Native Virtualization 4.20 | Fixed | RHSA-2026:59083 |
| Red Hat Container Native Virtualization 4.21 | Fixed | RHSA-2026:59062 |
| Red Hat Container Native Virtualization 4.22 | Fixed | RHSA-2026:60117 |
Not affected: 8 products
- Red Hat Container Native Virtualization 4.14
- Red Hat Container Native Virtualization 4.16
- Red Hat Container Native Virtualization 4.17
- Red Hat Container Native Virtualization 4.18
- Red Hat Container Native Virtualization 4.19
- Red Hat Container Native Virtualization 4.20
- Red Hat Container Native Virtualization 4.21
- Red Hat Container Native Virtualization 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-17527
- 2026-10-03 Alias added: GHSA-2cmm-29f6-xcpx
- 2026-11-03 Fix available: container-native-virtualization/virt-cdi-operator-rhel9@1793257366 · CNA
- 2026-11-03 1 new reference · CNA
- 2026-11-03 Fix available: RHSA-2026:93958 · Red Hat
- 2026-11-03 Fix available: Red Hat Container Native Virtualization 4.17 · Red Hat
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-17527 · CVE Program
- CVE-2026-17527 · NVD
- FIRST EPSS
- GHSA-2cmm-29f6-xcpx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-17527 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences