CVE-2026-17527
Received Received - Intake

Containerized Data Importer PVC Exfiltration via ClusterRole Misconfiguration

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Red Hat, Inc.

Description
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17527
EUVD
EUVD-2026-49135

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat containerized-data-importer *
redhat virt-cdi-operator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in containerized-data-importer (CDI) involves the aggregated cdi.kubevirt.io:view ClusterRole granting create permissions on the datavolumes/source subresource. This allows unauthorized users to clone any PersistentVolumeClaim (PVC) in the cluster, bypassing namespace isolation and read-only restrictions.

Detection Guidance

Check if the aggregated ClusterRole cdi.kubevirt.io:view exists and inspect its permissions using kubectl get clusterrole cdi.kubevirt.io:view -o yaml. Verify if it includes create permissions on datavolumes/source subresource. Also review ClusterRoleBindings for this role to identify users or service accounts with excessive permissions.

Impact Analysis

An attacker with view role access and write permissions in any namespace could exfiltrate data from any PVC in the cluster into a namespace they control. This bypasses security controls and allows unauthorized data access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating data protection requirements under GDPR, HIPAA, and other regulations that mandate strict access controls and data isolation.

Mitigation Strategies

Remove the create permission on datavolumes/source from the cdi.kubevirt.io:view ClusterRole. Audit all ClusterRoleBindings for this role and restrict access to only necessary namespaces. Update to the latest version of CDI where this issue is patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17527. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart