This vulnerability in KubeVirt CDI enables an authorization bypass that permits a user with limited privileges to clone PVCs from unauthorized namespaces. The flaw is due to insufficient access control checks on the DataImportCron PVC source, allowing unauthorized data access. The issue is tracked as CVE-2025-14459 with a CVSS v3.1 score of 8.5 (high severity), indicating network attack vector, low attack complexity, privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Red Hat has released OpenShift Virtualization 4.19.17 images that include fixes for this and other vulnerabilities.

Successful exploitation allows an attacker with limited privileges to access and clone PVCs from namespaces they should not have access to, resulting in unauthorized disclosure of potentially sensitive data. The confidentiality impact is high, while integrity impact is low and availability is unaffected. This could lead to data leakage across tenant boundaries in multi-tenant Kubernetes/OpenShift environments.

Red Hat has released OpenShift Virtualization 4.19.17 images that fix this vulnerability. Users should apply this update to remediate the issue. Before applying this update, ensure all previously released relevant errata are applied. Refer to Red Hat's official advisory at https://access.redhat.com/errata/RHSA-2026:0950 and https://access.redhat.com/security/cve/CVE-2025-14459 for detailed update instructions and confirmation of the fix. No alternative mitigations or workarounds are specified in the advisory.