GitHub Advisoryadvisory · Go
GHSA-mpmf-3w4r-qfpf KubeVirt has a Link Following issue
HIGH
Official page ↗
- Aliases
- CVE-2026-9804
- Ecosystem
- Go
- Packages
- kubevirt.io/kubevirt
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-59
- Reviewed
- 2026-07-01
Affected packages
• Go kubevirt.io/kubevirt: <= 1.9.0-beta.0 (no fix yet)
Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
Related
Alias · CVE (1)
- CVE-2026-9804 A flaw was found in KubeVirt's virt-exportserver component. vulnerability
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9804 advisory
- https://github.com/kubevirt/kubevirt/commit/6ea563fa94d8ca803f8dd9394cefd8cae36bb0ee web
- https://access.redhat.com/errata/RHSA-2026:27903 web
- https://access.redhat.com/errata/RHSA-2026:27913 web
- https://access.redhat.com/errata/RHSA-2026:27914 web
- https://access.redhat.com/errata/RHSA-2026:27983 web
- https://access.redhat.com/errata/RHSA-2026:28002 web
- https://access.redhat.com/security/cve/CVE-2026-9804 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2482487 web
- https://github.com/kubevirt/kubevirt package
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json web