High severity7.7NVD Advisory· Published May 28, 2026· Updated Aug 24, 2026
CVE-2026-9804
CVE-2026-9804
Description
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
kubevirt.io/kubevirtGo | <= 1.9.0-beta.0 | — |
Affected products
12- osv-coords10 versionspkg:apk/chainguard/virt-handler-1.7pkg:rpm/opensuse/kubevirt1.8&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/virt-chroot-fips-1.6pkg:apk/chainguard/virt-controller-fips-1.7pkg:apk/chainguard/virt-chroot-fips-1.8pkg:apk/chainguard/virt-controller-fips-1.8pkg:apk/chainguard/virt-controller-1.8pkg:rpm/opensuse/kubevirt-1.8&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kubevirt&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0+ 9 more
- (no CPE)range: < 0
- (no CPE)range: < 1.8.3-1.1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 1.8.3-1.1
- (no CPE)range: < 1.8.3-1.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-mpmf-3w4r-qfpfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-9804ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:27903nvdWEB
- access.redhat.com/errata/RHSA-2026:27913nvdWEB
- access.redhat.com/errata/RHSA-2026:27914nvdWEB
- access.redhat.com/errata/RHSA-2026:27983nvdWEB
- access.redhat.com/errata/RHSA-2026:28002nvdWEB
- access.redhat.com/security/cve/CVE-2026-9804nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/kubevirt/kubevirt/commit/6ea563fa94d8ca803f8dd9394cefd8cae36bb0eeghsaWEB
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.jsonnvdWEB
News mentions
0No linked articles in our index yet.