CVE-2026-17527

Name of the Vulnerable Software and Affected Versions containerized-data-importer (affected versions not specified)

Description The aggregated cdi.kubevirt.io:view ClusterRole, designed for read-only access to resources, incorrectly grants create permissions on the datavolumes/source subresource. The DataVolume clone authorization process accepts this permission to allow cloning any PersistentVolumeClaim (PVC) specified by the caller, without verifying write access to the source namespace. Consequently, a user or service account with the view role and write access (edit/admin) to any single namespace can exfiltrate the contents of any PVC across the cluster into a namespace they control, bypassing namespace isolation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.